CVE-2024-40498 PoC — PuneethReddyHc Online Shopping System Advanced 安全漏洞

Source

https://github.com/Dirac231/CVE-2024-40498

Associated Vulnerability

Title: PuneethReddyHc Online Shopping System Advanced 安全漏洞 (CVE-2024-40498)
Description:SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.php

Readme

# CVE-2024-40498
## Affected Application
- `online-shopping-system-advanced 1.0`
- https://github.com/PuneethReddyHC/online-shopping-system-advanced

## Description
The file `register.php` handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail, names and number, this leads to a SQL injection during the evaluation of the `VALUES()` statement. 

To exploit the vulnerability, send a POST request to the "register.php" file, adding a "address1" POST parameter with a SQL Injection payload that escapes the statement context. Alternatively, an attacker can use the "sqlmap" utility to exploit the issue automatically.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →