Student Result Management System 1.0 - Authentication Bypass SQL Injection

vendor:

Student Result Management System

by:

Ritesh Gohil

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: Student Result Management System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:projectnotes:student_result_management_system

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Win10 x64, Kali Linux x64

2020

Student Result Management System 1.0 – Authentication Bypass SQL Injection

An SQL injection vulnerability was discovered in the PHP Student Result Management System. The Admin Login Portal is vulnerable to SQL Injection, which could allow for the improper neutralization of special elements in SQL commands and may lead to the product being vulnerable to SQL injection.

Mitigation:

Ensure that user input is properly validated and sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Student Result Management System 1.0 - Authentication Bypass SQL Injection
# Google Dork: N/A
# Date: 11/16/2020
# Exploit Author: Ritesh Gohil
# Vendor Homepage: https://projectnotes.org/it-projects/student-result-management-system-in-php-with-source-code/
# Software Link: https://projectnotes.org/download/studentms-zip/
# Version: 1.0
# Tested on: Win10 x64, Kali Linux x64
# CVE : N/A
######## Description
#################################################################
#
#
# An SQL injection vulnerability discovered in PHP Student Result Management System #
#
#
# Admin Login Portal is vulnerable to SQL Injection
#
#
#
# The vulnerability could allow for the improper neutralization of special elements #
# in SQL commands and may lead to the product being vulnerable to SQL injection. #
#
#
######################################################################################

Kindly Follow Below Steps:
1. Visit the main page of the Student Result Management System.
2. You will get an Admin Login Page.
3. Payload which you can use in Email and password field:
*AND 1=0 AND '%'='
*4. You will get Admin Access of the Student Result Management System.