Aegon life v1.0 life insurance management system sql injection vulnerability. Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2024-06-14 |
Type : webapps |
Platform : php
This exploit / vulnerability Aegon life v1.0 life insurance management system sql injection vulnerability. is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Life Insurance Management System- SQL injection vulnerability.
# Exploit Author: Aslam Anwar Mahimkar
# Date: 18-05-2024
# Category: Web application
# Vendor Homepage: https://projectworlds.in/
# Software Link: https://projectworlds.in/life-insurance-management-system-in-php/
# Version: AEGON LIFE v1.0
# Tested on: Linux
# CVE: CVE-2024-36597
# Description:
----------------
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.Important user data or system data may be leaked and system security may be compromised. Then environment is secure and the information can be used by malicious users.
# Payload:
------------------
client_id=1511986023%27%20OR%201=1%20--%20a
# Steps to reproduce
--------------------------
-Login with your creds
-Navigate to this directory - /client.php
-Click on client Status
-Will navigate to /clientStatus.php
-Capture the request in burp and inject SQLi query in client_id= filed