3 Types of SQLi in `s` param - (Time/Boolean/Error Based)

Description I have found 3 types of SQLi on the s parameter Proof of Concept Time-Based Time-based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time in seconds before...

Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure

The plugin is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options. PoC - Install the plugin and set the API creds to: - Key:...

Senayan Library Management System 9.5.0 SQL Injection

Title: Senayan Library Management System v9.5.0 a.k.a SLIMS 9 BULIAN SQLi Author: nu11secur1ty Date: 11.03.2022 Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases Reference:...

UBUNTU-CVE-2022-39323

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST usertoken. This issue has been patched, please...

PT-2022-7397 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.4 Description: The issue is related to a time-based attack using a SQL injection in the API REST user token. This can allow a remote attacker to exploit the vulnerability, potentially leading to server port scannin...

Online Shopping System Advanced 1.0 SQL Injection Vulnerability

Title: online-shopping-system-advanced-1.0 SQLi Author: nu11secur1ty Vendor: https://github.com/PuneethReddyHC/online-shopping-system-advanced Software: https://github.com/PuneethReddyHC/online-shopping-system-advanced/archive/refs/heads/master.zip Reference:...

Moderators can perform Time based SQL injection attack.

The API endpoint /api/chat/users/setenabled POST is vulnerable to a Time based blind SQL injection attack via body parameter ‘userId’. It allows a Moderator to read, modify or delete the entries in the sqlite database. Moderator can leak the streamkey to access admin dashboard. Proof of concept...

CVE-2022-2891

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared...

Authentication flaw

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared...

CVE-2022-2891

The CVE-2022-2891 entry documents a time-based side-channel attack in the WP 2FA WordPress plugin prior to version 2.3.0. The vulnerability arises from comparison operators that do not mitigate timing differences, potentially leaking information about authentication codes during comparison. Affec...

CVE-2022-2891 WP 2FA < 2.3.0 - Time-Based Side-Channel Attack

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared...

Canteen Management 1.0 2022 SQL Injection Vulnerability

Title: Canteen-Management1.0-2022 SQLi Author: nu11secur1ty Vendor: https://www.mayurik.com/ Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/mayurik/2022/Canteen-Management/Docs/youthappam.zip?raw=true Reference:...

CVE-2021-45788

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...

CVE-2021-45788

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...

CVE-2021-45788

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...

Sql injection

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...

MeterSphere SQL注入漏洞

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere v1.15.4 version of the SQL injection vulnerability , the vulnerability stems from the existence of time-based SQL injection through the borders parameter...

CVE-2022-30004

Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection...

Sql injection

Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection...

PT-2022-19964 · Unknown · Sourcecodester Online Market Place Site

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Market Place Site version 1.0 Description: The issue allows remote attackers to dump the SQL database via time-based SQL injection. This is an unauthenticated blind SQL Injection, enabling attackers to access the databas...