Exploits / Vulnerability Discovered : 2018-10-30 |
Type : webapps |
Platform : php
This exploit / vulnerability Phptpoint pharmacy management system 1.0 username sql injection is for educational purposes only and if it is used you will do on your own risk!
# Description:
# phptpoint Pharmacy Management System SQL injection suffers from a SQL
# injection vulnerability that allows an attacker to bypass the login page
# and authenticate as admin or any other user.
# Vulnerable Code:
# 4 $username=$_POST['username'];
# 5 $password=$_POST['password'];
# 6 $position=$_POST['position'];
# 7 switch($position){
# 8 case 'Admin':
# 9 $result=mysql_query("SELECT admin_id, username FROM admin WHERE
# username='$username' AND password='$password'");
# 10 $row=mysql_fetch_array($result);