| शीर्षक | sourcecodester Expense Management System sql injection in report.php(authenticated) |
|---|
| विवरण | in report.php line 34-37 call the function fetch_report_credit, and the function is implementation in Home_model.php
public function fetch_report_credit($from,$to){
$query= $this->db->query("select (SELECT SUM(credit.amount) FROM credit,recep where credit.date between '$from' and '$to' AND credit.cus_id=recep.id) AS Total,credit.amount, credit.date, recep.name FROM recep,credit where credit.date between '$from' and '$to' AND credit.cus_id=recep.id ORDER BY credit.date");
return $query;
}
it is obvious that the post parameter from and to is weak to sql injection
after login ,we can access report.php and copy the request to txt file from burpsuite and run sqlmap to exploit
python .\sqlmap.py -r .\1.txt --dbs
|
|---|
| स्रोत | ⚠️ https://www.sourcecodester.com/php-codeigniter-expense-management-system-source-code |
|---|
| उपयोगकर्ता | wuerror (UID 30660) |
|---|
| सबमिशन | 06/08/2022 09:58 AM (4 साल पहले) |
|---|
| संयम | 06/08/2022 06:45 PM (9 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 205811 [SourceCodester Expense Management System POST Parameter report.php fetch_report_credit from/to SQL इंजेक्शन] |
|---|
| अंक | 17 |
|---|