EML Enterprise Address Book Management system v5.0 exists SQL injection

0x00 Preface

In Friday, when I wanted to practice practiced hand, casually find a system to download it to see.

And then found that there is a VIP version, but VIP to money, looked at the demo station, seemingly no change, more than a import function? Didn't look closely.

Search the system, there is no filter. Inject a bunch of points

0x01 Background Login Bypass

This system is very simple, just a backstage, login not to go in is nonsense

The system uses the MVP model, with the Smarty template

Without the installation page, the database is created by itself, the SQL file of the compressed package is directed in, and then it can be used normally.

So this system is two front page, a registration page, a landing page.

Look at the registration page first.

Look at the code logic

Without any filtering, the user name is brought directly into the database.

Take a look at the Burpsuite, error

Sqlmap is capable of running directly.

Then is the login page, there is no filtering, and here with Fetchrow (), to determine if there is no data returned to go in.

Here is what we often say the universal password, the same can be directly run Sqlmap.

So direct universal Password login backstage, the database is lazy run, login succeeded.

The system is in the background and there is no data to speak of.

As the preface says, there is almost always an injection of SQL statements where there is no filtering.

Not a list of them.

0X02 Emergency Update

Today again to the official website to see a bit, found out an emergency update.

Download the package and look at it with a beyond compare comparison. It was found that almost all the places were filtered.

So how is this filter function _runmagicquotes filtered?

First look at the magic quotes, but this has been removed in PHP 5.4. If not, use addslashes to filter.

Then our previous registration, the login page injection has been filtered out, it seems that the weekend someone sent an e-mail to the author ...

Looked carefully, found that there is no way to inject.

Because it is a session, there is no cookie, and there is no fake cookie to say.

That's all I can do.

0X03 Summary

Write more articles, even if this is very simple, write or write.

The simpler a system, the place to fill, the point of attack less, security is also relatively up.

EML Enterprise Address Book Management system v5.0 exists SQL injection