dsad

2026-04-19 21:10:40 +07:00
parent 5fdd214fdc
commit 27381d4e37
211 changed files with 53571 additions and 0 deletions
--- a/vuln-lab/web/www/profile.php
+++ b/vuln-lab/web/www/profile.php
@@ -0,0 +1,35 @@
+<?php
+// Integer-based SQLi — no quotes, full pipeline (error/bool/union/time).
+$dbh = @new mysqli(getenv('DB_HOST') ?: 'db', 'root', getenv('DB_PASS') ?: 'toor', getenv('DB_NAME') ?: 'newploit');
+
+$id = $_GET['id'] ?? '1';
+
+$sql = "SELECT id, username, email, role FROM users WHERE id=$id";
+$row = null;
+$err = '';
+if ($dbh && !$dbh->connect_errno) {
+    $res = @$dbh->query($sql);
+    if ($res === false) {
+        $err = $dbh->error;
+    } else {
+        $row = $res->fetch_assoc();
+    }
+}
+?><!DOCTYPE html>
+<html><body>
+<h1>User profile #<?= htmlspecialchars($id) ?></h1>
+
+<?php if ($err): ?>
+<pre style="color:#c00">You have an error in your SQL syntax: <?= $err ?>
+<?= htmlspecialchars($sql) ?></pre>
+<?php elseif ($row): ?>
+<p>User found:</p>
+<ul>
+    <li>username: <?= htmlspecialchars($row['username'] ?? '') ?></li>
+    <li>email:    <?= htmlspecialchars($row['email'] ?? '') ?></li>
+    <li>role:     <?= htmlspecialchars($row['role'] ?? '') ?></li>
+</ul>
+<?php else: ?>
+<p>No such user.</p>
+<?php endif; ?>
+</body></html>