Open Audit SQL Injection Vulnerability

##Full Disclosure

#Exploit Title : Open Audit SQL Injection Vulnerability
#Exploit Author : Rahul Pratap Singh
#Date : 2/Jan/2016
#Home page Link : https://github.com/jonabbey/open-audit
#Website : 0x62626262.wordpress.com
#Twitter : @0x62626262
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94

1. Description

“id” field in software_add_license.php is not properly sanitized, that
leads to SQL Injection Vulnerability.

“pc” field in delete_system.php, list_viewdef_software_for_system.php
and system_export.php is not properly sanitized, that leads to SQL
Injection Vulnerability.

2. Vulnerable Code:

software_add_license.php: ( line 12 to 13)

$sql = “SELECT * from software_register WHERE software_reg_id = ‘” .
$_GET[“id”] . “‘”;
$result = mysql_query($sql, $db);

delete_system.php: ( line 5 to 10)

if (isset($_GET[‘pc’])) {

$link = mysql_connect($mysql_server, $mysql_user, $mysql_password)
or die(“Could not connect”);
mysql_select_db(“$mysql_database”) or die(“Could not select database”);
$query = “select system_name from system where system_uuid='” .
$_GET[‘pc’] . “‘”;
$result = mysql_query($query) or die(“Query failed at retrieve
system name stage.”);

list_viewdef_software_for_system.php: ( line 2 to 3)

$sql = “SELECT system_os_type FROM system WHERE system_uuid = ‘” .
$_REQUEST[“pc”] . “‘”;
$result = mysql_query($sql, $db);

system_export.php: ( line 108 to 112)

if(isset($_REQUEST[“pc”]) AND $_REQUEST[“pc”]!=””){
$pc=$_REQUEST[“pc”];
$_GET[“pc”]=$_REQUEST[“pc”];
$sql = “SELECT system_uuid, system_timestamp, system_name FROM system
WHERE system_uuid = ‘$pc’ OR system_name = ‘$pc’ “;
$result = mysql_query($sql, $db);

pub ref:
http://www.securityfocus.com/archive/1/537226

Advertisements

ECommerceMajor SQL Injection Vulnerability


##Full Disclosure

#Exploit Title : ECommerceMajor SQL Injection Vulnerability
#Exploit Author : Rahul Pratap Singh
#Date : 13/Dec/2015
#Home page Link : https://github.com/xlinkerz/ecommerceMajor
#Website : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94

1. Description

“prodid” field in productdtl.php is not properly sanitized, that leads
to SQL Injection Vulnerability.

2. Vulnerable Code:

line 14 to 18

<?php

$getallproduct=”select * from purchase where id=$_GET[prodid] order by
id desc”;
$getallproductresult=mysql_query($getallproduct);
$getallproducttotal=mysql_num_rows($getallproductresult);

3. POC

http://127.0.0.1/ecommercemajor/productdtl.php?prodid=SQLI

Pub Ref:
http://www.securityfocus.com/archive/1/537107/30/0/threaded