suggestion:inject inside json parameter by click enter

[theLSA]

Json parameter must input *(v1.2.11/master)

If not input ,payload will like {"name":"key","value":"test"});WAITFOR DELAY '0:0:5'
Must input * like {"name":"key","value":""}

Idea for a solution

v1.2/v1.1.12 can click enter then inject inside.

[687766616e]

+1

[stamparm]

By click enter? I would suggest by clicking F7

[theLSA]

I mean that click enter is select 'y'(inject inside json) dafult.
Payload will add to the whole json's tail instead of inject inside(v1.2.11).
But v1.2 will inject inside automatically.

[stamparm]

@theLSA I would really need the whole console output to understand what is going on here. Please, understand that I can't decipher things like "v1.2/v1.1.12 can click enter then inject inside" <- I don't understand a thing what you are trying to say

[theLSA]

If not input * to specify parameter:
v1.2.11 console output(y-inject inside,but not in correct position-value):

it appears that provided value for POST parameter 'params' is JSON deserializable. Do you want to inject inside? [y/N] 

[21:56:15] [PAYLOAD] {"page":1,"pageSize":10,"sortName":"eId","sortOrder":"desc","whereparams":[{"name":"keyWord","value":"test"}]}) AND (SELECT 7200 FROM(SELECT COUNT(*),CONCAT(0x7176786b71,(SELECT (ELT(7200=7200,1))),0x7178627671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND (6417=6417
[21:56:15] [DEBUG] got HTTP error code: 500 (Internal Server Error)
[21:56:15] [PAYLOAD] {"page":1,"pageSize":10,"sortName":"eId","sortOrder":"desc","whereparams":[{"name":"keyWord","value":"test"}]} AND (SELECT 7200 FROM(SELECT COUNT(*),CONCAT(0x7176786b71,(SELECT (ELT(7200=7200,1))),0x7178627671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

---

v1.2 console output(in correct position-value):

params={"whereparams": [{"name": "keyWord", "value": "test%27%20ORDER%20BY%201--%20JWGF"}], "sortOrder": "desc", "page": 1, "pageSize": 10, "sortName": "eId"}

[stamparm]

My last reply to this issue as it is really hard to understand what author wanted to say.

A) By using:

--data='params={"whereparams": [{"name": "keyWord", "value": "test"}], "sortOrder": "desc", "page": 1, "pageSize": 10, "sortName": "eId"}' and answering 'y' to question it appears that provided value for POST parameter 'params' is JSON deserializable. Do you want to inject inside? [y/N] you are getting correct params value, like:

params=%7B%22whereparams%22%3A%20%5B%7B%22name%22%3A%20%22keyWord%29%20AND%209268%3DCAST%28%28CHR%28113%29%7C%7CCHR%28113%29%7C%7CCHR%28118%29%7C%7CCHR%28113%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%289268%3D9268%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28120%29%7C%7CCHR%28120%29%7C%7CCHR%2898%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29%20AND%20%282269%3D2269%22%2C%20%22value%22%3A%20%22test%22%7D%5D%2C%20%22sortName%22%3A%20%22eId%22%2C%20%22sortOrder%22%3A%20%22desc%22%2C%20%22pageSize%22%3A%2010%2C%20%22page%22%3A%201%7D

which is decoded:

params={"whereparams": [{"name": "keyWord) AND 9268=CAST((CHR(113)||CHR(113)||CHR(118)||CHR(113)||CHR(113))||(SELECT (CASE WHEN (9268=9268) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(120)||CHR(98)||CHR(113)) AS NUMERIC) AND (2269=2269", "value": "test"}], "sortName": "eId", "sortOrder": "desc", "pageSize": 10, "page": 1}

---

B) By using:

--data='params={"whereparams": [{"name": "keyWord", "value": "test"}], "sortOrder": "desc", "page": 1, "pageSize": 10, "sortName": "eId"}' and answering 'n' to question it appears that provided value for POST parameter 'params' is JSON deserializable. Do you want to inject inside? [y/N] you are getting correct params value, like:

params=%7B%22whereparams%22%3A%20%5B%7B%22name%22%3A%20%22keyWord%22%2C%20%22value%22%3A%20%22test%22%7D%5D%2C%20%22sortOrder%22%3A%20%22desc%22%2C%20%22page%22%3A%201%2C%20%22pageSize%22%3A%2010%2C%20%22sortName%22%3A%20%22eId%22%7D%29%20AND%204116%3DCAST%28%28CHR%28113%29%7C%7CCHR%28120%29%7C%7CCHR%28106%29%7C%7CCHR%28118%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%284116%3D4116%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28113%29%7C%7CCHR%28118%29%7C%7CCHR%28107%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29%20AND%20%283090%3D3090

which is decoded:

params={"whereparams": [{"name": "keyWord", "value": "test"}], "sortOrder": "desc", "page": 1, "pageSize": 10, "sortName": "eId"}) AND 4116=CAST((CHR(113)||CHR(120)||CHR(106)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (4116=4116) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(118)||CHR(107)||CHR(113)) AS NUMERIC) AND (3090=3090

---

Difference between A and B is the answer to that same question. A) results with valid JSON, while in case of B), original value of params is being treated as a RAW text, like in any other non-structured form