ECommerceMajor - 'productdtl.php?prodid' SQL Injection

Author: Rahul Pratap Singh
type: webapps
platform: php
port: 80.0
date_added: 2015-12-14 
date_updated: 2017-10-18 
verified: 1 
codes: OSVDB-131782 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comecommerceMajor-master.zip

#Exploit Title      : ECommerceMajor SQL Injection Vulnerability
#Exploit Author  : Rahul Pratap Singh
#Date                 : 13/Dec/2015
#Home page Link  : https://github.com/xlinkerz/ecommerceMajor
#Website            : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94

1. Description

"prodid" field in productdtl.php is not properly sanitized, that leads to
SQL Injection Vulnerability.

2. Vulnerable Code:

line 14 to 28

<?php
$getallproduct="select * from purchase where id=$_GET[prodid] order by id
desc";
$getallproductresult=mysql_query($getallproduct);
$getallproducttotal=mysql_num_rows($getallproductresult);

3. POC

http://127.0.0.1/ecommercemajor/productdtl.php?prodid=SQLI