Travel Agency 1.1 SQL Injection

2018.06.23

UltraSecurityTeam (FR)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

# Exploit Title: Travel Agency 1.1 SQL Injection 
# Data: 06.23.2018
# Exploit Author: Ashkan Moghaddas
# Tested on: Windows - Linux
# Google Dork: N/A


=========
Vulnerable Page:
=========
/admin/add.city.php


==========
Vulnerable Source:
==========
Line20:if(isset($_GET['action']) && ($_GET['action'] == 'del')){
Line21:$delete = mysql_query("DELETE FROM destination where destination_id = '".$_GET['cid']."'");


=========
POC:
=========
http://site.com/admin/add.city.php?cid=[SQL]


============================
WebSite : UltraSec.Org
Channel : @UltraSecurity
Email : ashkanmoghaddas77@gmail.com



Special Thanks : Abolfaz Hajizadeh , MrQadir , Milad Ranjbar 

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Travel Agency 1.1 SQL Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.