PbootCMS 3.0.4 has SQL injection

Vulnerability Type :

SQL Injection

Vulnerability Version :

3.0.4

Recurring environment:

• Mac OS
• PHP 5.4.60
• Apache 2.4.23
• Mysql 5.7.26

Vulnerability Description AND recurrence:

The default database is sqlite. For testing convenience, we need to replace the default database with the mysql database.
the mysql database directory:
pbootcms\static\backup\sql\0cb2353f8ea80b398754308f15d1121e_20200705235534_pbootcms.sql

page:
http://xxx/?aboutus/
http://xxx/?article/
http://xxx/?product/
http://xxx/?case/
http://xxx/?job/
http://xxx/?gbook/
http://xxx/?contact/
They all have vulnerabilities, but they all work the same way
I'm just going to use http://xxx/?case/ as an explanation

Boolean-based blind SQL injection happened in this page.
The path following case/ is concatenated into the "where" statement causing SQL injection

When the condition is true:

When the condition is false:


payload:
Because %20 will be replaced by _ ,So use %0a to bypass it.
For example:


we can get the admin account name and password

Detailed information:
1:
Vulnerability code：/apps/home/controller/IndexController.php
The $qs variable takes the path and inserts the data into the "WHERE" statement simply through the parse_str() method

That's why %20 becomes _
For example:

2:After obtaining the path data, it is directly passed into the "WHERE" statement to cause SQL injection