Thatware 0.4.6 - SQL Injection

Author: Besim
type: webapps
platform: php
port: 
date_added: 2016-10-13 
date_updated: 2016-10-13 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comthatware_0.4.6.tar.gz

# Exploit Title :----------------- : Thatware 0.4.6 - (friend.php) - SQL Injection
# Author :------------------------ : Besim
# Google Dork :---------------- :  -
# Date :-------------------------- : 13/10/2016
# Type :-------------------------- : webapps
# Platform : -------------------- :  PHP
# Vendor Homepage :------- : -
# Software link : -------------- : https://www.exploit-db.com/apps/13132b3e0eaeffc3fad55fded9e5bdc6-thatware_0.4.6.tar.gz


############################ SQL INJECTION Vulnerabilty ############################

*-* Code *-*

include ("header.php");
$result=mysql_query("select title from stories where sid=$sid")

*-* Vulnerable parameter-: $sid

*-* File-----------------: friend.php?sid=(SQL inj)