Title: WHMCS SQL Injection Vulnerablity 

Author: MaX-HaCker

WHMCS SQL Injection Vulnerability. This is a very old vulnerability but still works.

Lets Start

Firstly find a vulnerable site by using Google Dork

inurl:"weblink_cat_list.php?bcat_id="

URL will be something like this

http://www.example.com/oldweb_kroobannok/weblink_cat_list.php?bcat_id=1
Then change the url from

http://www.example.com/oldweb_kroobannok/weblink_cat_list.php?bcat_id=1 

to

Bang ! All username as well as passwords will be shown. Now login with that credentials.