# Exploit Title: User Registration & Login and User Management System With admin panel - SQL Injection (Auth Bypass)
# Date: 2021-07-01
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 2.1
# Tested on: Windows 10
Injection flaws, such as SQL, NoSQL, and LDAP injection, occur when
untrusted data is sent to an interpreter as part of a command or query. The
attacker’s hostile data can trick the interpreter into executing unintended
commands or accessing data without proper authorization.
An attacker can gain admin panel access using malicious sql injection queries.
Steps to reproduce:
1) Open admin login page using following URl:
2) Now put the payload below the Username and password field.
Payload: admin' or '1'='1 and you will be successfully logged In as Admin without any credentials.
TAPESH DIGITAL SECURITY TEAM IRAN T.ME/ICTUS_TM | تیم امنیت سایبری تپش