session_start();
if(isset($_POST['username'])){
$_SESSION['login'] = $_POST['username'];
if($_SESSION['login'] == "Administrator"){
echo "Logged in as Admin!!";
} else {
echo "Logged in as " . $_POST['username'] . "<br>";
}
} else {
echo "<h1>No username is defined</h1>";
}
?>```
Details:
Exploit Type:
Exploitable Line:
Patched Line:
SUBMİT!
EXAMPLE
$title = “HBH Example”;
echo “
”.$title.“
”;
echo “Hello, ” . $_GET[‘name’] . “
”;
?>```
Example Answer:
Exploit Type: Cross Site Scripting
Exploitable Line: 4
Patched Line: echo “Hello, ” . strip_tags($_GET[‘name’]) . “
”;
