CVE-2024-40498 PoC — PuneethReddyHc Online Shopping System Advanced 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2024-40498
## Affected Application
- `online-shopping-system-advanced 1.0`
- https://github.com/PuneethReddyHC/online-shopping-system-advanced

## Description
The file `register.php` handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail, names and number, this leads to a SQL injection during the evaluation of the `VALUES()` statement. 

To exploit the vulnerability, send a POST request to the "register.php" file, adding a "address1" POST parameter with a SQL Injection payload that escapes the statement context. Alternatively, an attacker can use the "sqlmap" utility to exploit the issue automatically.

File Snapshot

 [4.0K]  /data/pocs/07264303b0ff13f35499eaf4632998d087ea6fff
└── [ 683]  README.md

0 directories, 1 file

Remarks