hits script 1.0 – ‘item_name’ SQL Injection
# Exploit Title: hits script 1.0 - 'item_name' SQL Injection # Date: 2020-04-27 # Exploit Author: SajjadBnd # Vendor Homepage: https://hits.ir # Software Link: http://dl.persianscript.ir/script/hitsir-script-persian%28PersianScript.ir%29.zip # Software Link(mirror): http://dl.nuller.ir/hitsir-script-persian[www.nuller.ir].zip # Version: 1.0 # Tested on: Win10 Professional x64 [ description of script ] With this script you can set up a site to exchange statistics and traffic as well as increase rankings. In this script, it is possible to exchange Google +1, exchange Facebook points, exchange Twitter followers, exchange YouTube visitors, exchange visit statistics. [ poc ] file : ipn.php parameters : 'item_name' , 'item_number' method : POST source [ 36: mysql_query $pack = mysql_fetch_object(mysql_query("SELECT * FROM `c_pack` WHERE `name`='{$item_name}' AND `coins`='{$item_number}'")); 19: $item_name = $_POST['item_name']; 20: $item_number = $_POST['item_number']; requires: 4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename"))) 31: if(!$fp) else 35: if(strcmp($res, "VERIFIED") == 0) ] parameter : 'custom' method : POST source [ 43: mysql_query mysql_query("UPDATE `users` SET `coins`=`coins`+'{$pack->coins}' WHERE `id`='{$custom}'"); 27: $custom = $_POST['custom']; requires: 4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename"))) 31: if(!$fp) else 35: if(strcmp($res, "VERIFIED") == 0) 41: if(($receiver_email == $site->paypal) && ($payment_amount == $pack->price) && ($payment_status == 'Completed')) ] parameters : 'item_name','mc_gross' method : POST source [ 44: mysql_query mysql_query("INSERT INTO `transactions` (user, points, pack, money, date) VALUES('{$user->login}', '{$pack->coins}', '{$item_name}', '{$payment_amount}', NOW())"); 19: $item_name = $_POST['item_name']; 22: $payment_amount = $_POST['mc_gross']; requires: 4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename"))) 31: if(!$fp) else 35: if(strcmp($res, "VERIFIED") == 0) 41: if(($receiver_email == $site->paypal) && ($payment_amount == $pack->price) && ($payment_status == 'Completed')) ] file : register.php parameters : 'PlusREF','register' method : COOKIE,POST source [ 22: mysql_query $user1 = mysql_query("SELECT * FROM `users` WHERE `id`='{$ref}'"); 21: $ref = $_COOKIE['PlusREF']; requires: 3: if(isset($_POST['register'])) 19: if(!checkpwd ($sec['password'], $sec['password2'])) else 20: if(isset($_COOKIE['PlusREF'])) ] & source [ 40: mysql_query mysql_query("INSERT INTO `users`(email,login,IP,pass,passdecoded,ref,signup,activate) values('{$sec['email']}','{$sec['user']}','$final','$passc','$passa','{$ref}',NOW(),'{$activare}')") or 37: $final = visitorip (); 39: $passc = md5($passa); 38: $passa = $sec['password']; 38: $passa = $sec['password']; 21: $ref = $_COOKIE['PlusREF']; // if(isset($_COOKIE)), 26: $activare = rand(000000000, 999999909); requires: 3: if(isset($_POST['register'])) 19: if(!checkpwd ($sec['password'], $sec['password2'])) else ] |