Hey, what's up security guys, Rom is in the area.
Discovered by Rom The Vosso Rômulo
Contact: vossoromulo@tuta.io
Website: http://www.cienciaemacao.ufv.br/
Vuln Path: detalheElemento.php?idElemento=1'
Vulnerability: SQL Injection
Proof of Concept
1 . Go to Website..
2 . In the URL put our Vuln Path..
3 . And READY, this return SQL error!
Example: http://www.cienciaemacao.ufv.br/detalheElemento.php?idElemento=1%27
Error: Impossivel de pegar a Evento. You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '\'' at line 3
Now i think you can exploit this vuln using your hands or using exploit tools as sqlmap.
G00D H4CK1NG!