CVE-2024-34222 PoC — Human Resource Management System 安全漏洞

Source

Associated Vulnerability

Description

CVE-2024-34222 | SQL injection

Readme

# Human Resource Management System 1.0
#### Submitter: Kha Do

## Vulnerability
SQL injection

## Description
SQL injection vulnerability in /hrm/country.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the **searccountry** parameters.

## Affected component
Path URL: /hrm/country.php

Parameter: **&searccountry**=[inject here]

## Impact
This vulnerability allow attackers allow attackers to execute arbitrary SQL commands via the **searccountry** parameters

## POC
When searching country with the incorrect condition `' and '1'='2'#`, no results are returned: 
![incorrect](https://github.com/dovankha/CVE-2024-34222/assets/63991630/34444a26-a42f-4cb4-928d-32ec39c3c35f)

And, when searching country with the incorrect condition `' and '1'='1'#`, all results are returned: 
![correct](https://github.com/dovankha/CVE-2024-34222/assets/63991630/6c3a0476-5346-443a-b361-c910f9fa0cac)

File Snapshot

 [4.0K]  /data/pocs/96cd95321a648c12ab18e0a9f2d80c74901a38f0
└── [ 952]  README.md

0 directories, 1 file

Remarks