Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Mar 2015 02:09:32 +0700
From: "Steevee a.k.a Stefanus" <>
Subject: Instant v2.0 SQL Injection Vulnerability

Instant v2.0 SQL Injection Vulnerability

: # Exploit Title : Instant v2.0 SQL Injection Vulnerability
: # Date : 10th March 2015
: # Author : X-Cisadane
: # CMS Name : Instant v2.0 (another OverCoffee production)
: # CMS Developer :
: # Version : 2.0
: # Category : Web Applications
: # Vulnerability : SQL Injection
: # Tested On : Google Chrome Version 40.0.2214.115 m (Windows 7), Havij
1.16 Pro & SQLMap 1.0-dev-nongit-20150125
: # Greetz to : Explore Crew, CodeNesia, Bogor Hackers Community, Ngobas
and Winda Utari

A SQL Injection Vulnerability has been discovered in the Instant v.2.0 CMS.
The Vulnerability is located in the subid Value of the product_cat.php
File. Attackers are able to execute own SQL commands
by usage of a GET Method Request with manipulated subid Value.
Attackers are able to read Database information by execution of own SQL

DORKS (How to find the target) :
"Powered By Instant" inurl:/catalog/
Or use your own Google Dorks :)

Proof of Concept

SQL Injection
PoC :
And you have to change the URL structure to

Example :

Just change the URL structure to'16617
And you'll see this error notice : You have an error in your SQL syntax;
check the manual that corresponds to your MySQL ...

Note : This CMS stored Credit Card Infos on the Database, just open your
Fav Tool and Dump the orders Table
PIC / PoC :

Another Vuln Sites :['SQLi]['SQLi]['SQLi]['SQLi]['SQLi]
... etc ...

-= Regards =-
 Steevee A.K.A

Content of type "text/html" skipped

View attachment "poc.txt" of type "text/plain" (2683 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.