[Sir Paul McCartney]

So yeah, I think I found a SQL vulnrability on a MC server that banned me, lawl.
So yeah; http://www.dungeonrealms.net/bans/index.php
Just type ' into the username it it returns;
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
I guess you guys know what to do, if you can do anything let me know :p

edit;
it's XSS vuln too,
I tried <font color=red>test</font>' and it returned;
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''test''' at line 1

I'm not very good at hacking websites lol, I know some of you are pretty good and i guess this seems like an easy target.

[rfpd]

It's vulnerable to SSI not SQLi, trying to upload a shell for you

---

Nevermind you are right I've found sql, blind and xss

[AlphaDelta]

It's definitely exploitable,



I'm not entirely sure if any of those tables would contain any useful information considering I haven't been anywhere else on the website other than that link.

[rfpd]

Use xss to get cookies I don't think you can get some logins from this tables

[Sir Paul McCartney]

AlphaDelta, you are awesome.
All of the fields are part of the game,
dungeonrealms.net,
Is it possible to drop the database or something like that?

[benzi]

yes,you can drop the db.
its regular string injection-

Code

'and 0 union select version(),2,3,4,5,6,7,8,9-- -

5.5.28a-MariaDB
follow this tut
https://hackforums.net/showthread.php?tid=1923250
but pay attention for string.

[rfpd]

I hacked it using tamper data lol o.O

[Sir Paul McCartney]

Feel free to do what you want, because it will ruin the ingame!
It will be so funny as they usually charge $10 to play on the server, because it's in heavy BETA, it's OPEN BETA weekend so anyone can join, will be hilarious if they have no backups.

[rfpd]

Feel free to do what you want, because it will ruin the ingame!
It will be so funny as they usually charge $10 to play on the server, because it's in heavy BETA, it's OPEN BETA weekend so anyone can join, will be hilarious if they have no backups.

I don't think you can hack anything it doesn't seem to have admin table information

[Sir Paul McCartney]

Doesn't matter, they use minecraft as the game (which the accounts will be seperate for) but the use the MySQL database to store info for the game.
If the database was gone the whole server would just crumble

[LevelUp]

I took a look through and there doesn't seem to be anything of crucial status.

Code

'and 1=0 union select 1,2,3,4,5,6,7,8,group_concat(0x3c62723e,table_name) from information_schema.tables where table_schema=database()-- -

[Coffee]

There doesn't see to be any "game ruining" information in that database, not really worth the effort

[Sir Paul McCartney]

There doesn't see to be any "game ruining" information in that database, not really worth the effort

They use that database only for storing like your gems, ect
The user database isn't accesible by anyone because it uses Minecraft..

[Butofort]

Ohh i like it :D very nice man thank