Tag
#sql
Computer Laboratory Management System version 1.0 suffers from an incorrect access control that allows for privilege escalation.
Leads Manager Tool suffers from remote SQL injection and cross site scripting vulnerabilities.
Readymade Unilevel Ecommerce MLM suffers from remote blind SQL injection and cross site scripting vulnerabilities. These issues affected the version released as late as March 15, 2024.
AccPack Buzz version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
Readymade Real Estate Script suffers from remote blind SQL injection and cross site scripting vulnerabilities.
Ubuntu Security Notice 6934-1 - Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.39 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
SchoolPlus LMS version 1.0 suffers from a remote SQL injection vulnerability.
AccPack Khanepani version 1.0 suffers from an insecure direct object reference vulnerability.
AccPack Cop version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
### Summary Probably jwt bypass + sql injection or what i'm doing wrong? ### PoC (how to reproduce) 1. Create following files: docker-compose.yml: ``` services: postgres: image: postgres container_name: postgres_container_mre environment: POSTGRES_USER: test_user_pg POSTGRES_PASSWORD: test_pass_pg POSTGRES_DB: test_db prest: image: prest/prest build: . volumes: - ./queries:/queries - ./migrations:/migrations ports: - "3000:3000" ``` Dockerfile: ``` from prest/prest:latest COPY ./prest.toml prest.toml ``` prest.toml: ``` debug=false migrations = "./migrations" [http] port = 3000 [jwt] default = true key = "secret" algo = "HS256" [auth] enabled = true type = "body" encrypt = "MD5" table = "prest_users" username = "username" password = "password" [pg] URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable" [ssl] mode = "disable" sslcert = "./PATH" sslkey = "./PATH" sslrootcert = "....