Alumni Management System 1.0 Blind SQL Injection

Alumni Management System version 1.0 suffers from a remote blind SQL injection vulnerability. SQL injection was originally discovered in this version in October of 2020 by Ankita Pal.

MD5 | ee217b1351dde819a8391c30c3dd1f05

# Exploit Title: Blind SQL injection on Alumni Management System # Date: 23/10/2020
# Exploit Author: Valerio Alessandroni
# Vendor Homepage:
# Software Link: ource-code.html
# Version: 1.0
# Tested on: ubuntu 18.04
# CVE : CVE-2020-28070
# Description:
Blind SQL injection vulnerability on Alumni Management System v1.0 allows remote attackers to execute arbitrary SQL commands via the "id" GET parameter through the page view_event.php on line 4.
# Reproduction:
Just visit the page and replace "id" get parameter with the SQL code to exploit this Blind SQL Injection

Related Posts