Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

小额金融管理系统 V1.0 SQL注入漏洞（未认证） 1. 描述： Microfinance Management System 在 /mims/updatecustomer.php 中通过参数 'customernumber' 允许 SQL 注入。利用此问题可让攻击者破坏应用程序、访问或修改数据，或利用底层数据库中的潜在漏洞。 2. 验证概念（PoC）： 在 Burpsuite 中拦截受影响页面中带有 'customernumber' 参数的请求，并将其保存为 poc.txt，然后运行 SQLmap 从数据库中提取数据： sqlmap.py -r poc.txt --dbms=mysq...

VulnCheck KEV: CVE-2022-27927

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable coursecode and/or customernumber parameter...

CVE-2022-27927: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable coursecode and/or customernumber parameter...