Movie Rating System 1.0 - SQL Injection to RCE (Unauthenticated)

Movie Rating System 1.0 - SQL Injection to RCE (Unauthenticated)

Exploit / Project Details

Python Tue Dec 21 2021

Zero-Day Discovery & Exploit Development: Movie Rating System SQLi to RCE

Detailed Write-up

Introduction

In this report, we will examine a critical SQL Injection vulnerability detected in the "Movie Rating System 1.0" application and how this vulnerability can be escalated to a Remote Code Execution (RCE) attack. This attack allows an unauthenticated attacker to gain full control over the server.

Vulnerability Analysis

SQL Injection Point

Upon examining the movie_details.php file, which displays movie details, we see that the id parameter is included directly in the SQL query without sufficient security measures.

// Vulnerable Code in movie_details.php
if(isset($_GET['id'])){
    $qry = $conn->query("SELECT * FROM `movie_list` where id = '{$_GET['id']}'");
    // ...
}

In the code above, the $_GET['id'] variable is added to the query without any sanitization or use of prepared statements. This allows an attacker to manipulate the SQL query and perform unauthorized operations on the database.

Exploit Development

The exploit (exploit.py) I developed to escalate this vulnerability to an RCE attack follows these steps:

  1. Target and Page Detection: The exploit takes the target URL, finds the "Movies" page, and reaches a valid movie detail page (movie_details.php?id=...).

  2. Path Disclosure:
    The attacker adds a single quote (') character to the id parameter to generate an SQL syntax error. If error messages are enabled on the server (display_errors = On), PHP returns a warning message containing the full physical path of the file on the server (e.g., C:\xampp\htdocs\movie\movie_details.php). The exploit parses this error to obtain the web root directory (C:/xampp/htdocs/movie/).

  3. SQL to RCE (INTO OUTFILE):
    After obtaining the file path, MySQL's INTO OUTFILE feature is used to write a malicious PHP file to the server.

    Payload Logic Used:

    -1881' OR 1881=1881 LIMIT 0,1 INTO OUTFILE 'C:/xampp/htdocs/movie/shell.php' LINES TERMINATED BY 0x3c3f70687020... -- -

    Here, the LINES TERMINATED BY clause is critical. Normally, while the query result is written to the file, the hex-encoded PHP shell code (<?php ... system($cmd); ... ?>) determined by the attacker is added to the end of the lines. Thus, the created file becomes an executable PHP file by the server.

    Note: For this attack to be successful, the database user must have the FILE privilege, and the secure_file_priv setting must allow file writing.

  4. Code Execution:
    After the file is successfully created, the exploit sends an HTTP request to the shell.php file and executes the whoami command to verify its authority on the system.

Remediation

To fix this critical vulnerability, the following steps must be applied:

1. Use Prepared Statements:
Instead of directly concatenating user inputs in SQL queries, Prepared Statements must be used.

Secure Code Example:

$stmt = $conn->prepare("SELECT * FROM `movie_list` where id = ?");
$stmt->bind_param("s", $_GET['id']);
$stmt->execute();
$qry = $stmt->get_result();

2. Hide Error Messages:
Displaying PHP error messages to the user in the production environment should be prevented. display_errors should be set to Off in the php.ini file.

3. Restrict Database Privileges:
The database user used by the web application should not be granted high privileges such as FILE. Only necessary privileges like SELECT, INSERT, UPDATE, DELETE should be defined.

4. secure_file_priv Setting:
In the MySQL configuration, the secure_file_priv setting should be directed to a secure directory outside the web root or set to NULL to restrict file operations.

Source Code Explorer
/
Select a file
2024 © Tağmaç Han