Travel Agency 1.1 SQL Injection

2018.06.23

UltraSecurityTeam (FR)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

# Exploit Title: Travel Agency 1.1 SQL Injection
# Data: 06.23.2018
# Exploit Author: Ashkan Moghaddas
# Tested on: Windows - Linux
# Google Dork: N/A
=========
Vulnerable Page:
=========
/admin/add.city.php
==========
Vulnerable Source:
==========
Line20:if(isset($_GET['action']) && ($_GET['action'] == 'del')){
Line21:$delete = mysql_query("DELETE FROM destination where destination_id = '".$_GET['cid']."'");
=========
POC:
=========
http://site.com/admin/add.city.php?cid=[SQL]
============================
WebSite : UltraSec.Org
Channel : @UltraSecurity
Email : ashkanmoghaddas77@gmail.com
Special Thanks : Abolfaz Hajizadeh , MrQadir , Milad Ranjbar 

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Travel Agency 1.1 SQL Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.