| शीर्षक | SourceCodester Online Eyewear Shop SQL Injection |
|---|
| विवरण | The application Online Eyewear Shop is vulnerable to SQL Injection Error-based attacks.
The vulnerable parameter is the "id" GET param inside the following requested URL:
- http://localhost/oews/?p=products/view_product&id=*
The above URL is related to the following source code file:
- oews/products/view_product.php
The payloads I used to determine whether the application is vulnerable are the followings:
- id=7' AND '1'='2 -> The application prints an error alert and kicks me out of the page
- id=7' AND '1'='1 -> The application approves the query and shows me the product related to the id equal to 7
|
|---|
| उपयोगकर्ता | secpconti (UID 40229) |
|---|
| सबमिशन | 03/02/2023 11:53 PM (4 साल पहले) |
|---|
| संयम | 04/02/2023 08:29 AM (9 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 220195 [SourceCodester Online Eyewear Shop 1.0 view_product.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 17 |
|---|