The Hacker News Logo
Subscribe to Newsletter
CrowdSec

The Hacker News - Cybersecurity News and Analysis: Search results for SQL Injection

The Mole - Another Automatic SQL Injection exploitation tool

The Mole - Another Automatic SQL Injection exploitation tool

December 10, 2011Mohit Kumar
The Mole - Another Automatic SQL Injection exploitation tool The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique. Features Support for injections using Mysql, SQL Server, Postgres and Oracle databases. Command line interface. Different commands trigger different actions. Auto-completion for commands, command arguments and database, table and columns names. Support for query filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily. Exploits SQL Injections through GET and POST methods. Developed in python 3. Video Demonstration: 1.)  Installation Guide 2.) Tutorial to Use 3.) Download Mole
Nikjju Mass injection campaign target more than 2 Millions Urls

Nikjju Mass injection campaign target more than 2 Millions Urls

April 18, 2012Mohit Kumar
Nikjju Mass injection campaign target more than 2 Millions Urls Daniel Cid an open source developer and information security professional reported on Sucuri blog that their team tracked a new mass SQL injection campaign that started early this month and till now more than 180,000 URLs have been compromised.  Nikjju is a mass SQL injection campaign targeting ASP/ASP.net sites. At the time of writing Google has identified 361,000 pages infected with that javascript call, but the number is growing really fast. In this case it adds the following javascript to the compromised sites. One more interesting fact that researchers have noticed that  Nikjju.com domain was registered on April 1st 2012 and in 18 days more than 180,000 urls get infected. This mass Sql Injection also compromise some Government sites also , as listed below : jnd.xmchengdu.gov.cn study.dyny.gov.cn www.cnll.gov.cn www.bj.hzjcy.gov.cn www.mirpurkhas.gov.pk www.tdnyw.gov.cn gcjs.kaifeng.gov.cn Few hours we h
These Top 10 Programming Languages Have Most Vulnerable Apps on the Internet

These Top 10 Programming Languages Have Most Vulnerable Apps on the Internet

December 04, 2015Swati Khandelwal
A new research showed that Scripting languages, in general, give birth to more security vulnerabilities in web applications, which raised concerns over potential security bugs in millions of websites. The app security firm Veracode has released its State of Software Security: Focus on Application Development report ( PDF ), analyzing more than 200,000 separate applications from October 1, 2013, through March 31, 2015. The security researchers crawled popular web scripting languages including PHP, Java, JavaScript, Ruby, .NET, C and C++, Microsoft Classic ASP, Android, iOS, and COBOL, scanning hundreds of thousands of applications over the last 18 months. Also Read:  A Step-by-Step Guide — How to Install Free SSL Certificate On Your Website Researchers found that PHP – and less popular Web development languages Classic ASP and ColdFusion – are the riskiest programming languages for the Internet, while Java and .NET are the safest. Here's the Top 10 List:
Critical Sqli Vulnerability in channel [V] Website

Critical Sqli Vulnerability in channel [V] Website

June 10, 2012Mohit Kumar
Critical Sqli Vulnerability in channel [V] Website A 16 years old White Hat Hacker " Arjun Siyag " from India discover a Critical Sqli Vulnerability in channel [V] Website ( https://www.channelv.in ). Proof of the hack is as shown in above image. Hacker disclose only the admin username and password, which will not effect the admin panel directly,because for login Email ID is required.  SQL Injection is one of the many web attack mechanisms used by hackers to steal data from organisations. It is perhaps one of the most common application layer attack techniques used today. Through SQL Injection, the hacker may input specifically crafted SQL commands with the intent of bypassing the login form barrier and seeing what lies behind it. This is only possible if the inputs are not properly sanitised (i.e., made invulnerable) and sent directly with the SQL query to the database. SQL Injection vulnerabilities provide the means for a hacker to communicate directly to the database.
Embassy of Kazakhstan hacked by Anonymous Supporters

Embassy of Kazakhstan hacked by Anonymous Supporters

January 30, 2012Mohit Kumar
Embassy of Kazakhstan hacked by Anonymous Supporters The official website of Embassy of Kazakhstan in Delhi having SQL injection Vulnerability, and Hacker with codename -  Abs0luti0n has successfully Extract the database tables info and leak it on a pastebin note  including Admin's Username and Password. Hacker said," Lately we have been experimenting on some new large targets which will be unveiled soon. However today while we were cruising around in our lulzmobile,we set sights momentarily on another outdated weak vehicle and with great ease put the pedal to the metal, ran all the lights and flew straight through our accquired target ." SQL Injection is a type of web application security vulnerability in which an attacker is able to submit a database SQL command which is executed by a web application, exposing the back-end database. Attackers utilize this vulnerability by providing specially crafted input data to the SQL interpreter in such a manner that the int
Critical Flaws in Philips TASY EMR Could Expose Patient Data

Critical Flaws in Philips TASY EMR Could Expose Patient Data

November 08, 2021Ravie Lakshmanan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of critical vulnerabilities affecting Philips Tasy electronic medical records (EMR) system that could be exploited by remote threat actors to extract sensitive personal data from patient databases. "Successful exploitation of these vulnerabilities could result in patients' confidential data being exposed or extracted from Tasy's database, give unauthorized access, or create a denial-of-service condition," CISA  said  in a medical bulletin issued on November 4. Used by over 950 healthcare institutions primarily in Latin America, Philips Tasy EMR is designed as an  integrated healthcare informatics  solution that enables centralized management of clinical, organizational and administrative processes, including incorporating analytics, billing, and inventory and supply management for medical prescriptions. The  SQL injection  flaws — CVE-2021-39375 and CVE-2021-39376 — affect Tasy EMR HTML5
Timesofmoney Database Hacked using Sql Injection Vulnerability

Timesofmoney Database Hacked using Sql Injection Vulnerability

August 04, 2011Mohit Kumar
Timesofmoney Database Hacked using Sql Injection Vulnerability General Information About the Vulnerability This is again a critical vulnerability discovery made by zSecure Team in TimesofMoney website. The group claims that there exist a critical SQL Inejction Vulnerability in the timesofmoney's website using which an attacker can gain access to the site's entire database which contains the huge amount of customers confidential information. Even many indian banks are availing the service of the timesofmoney. This vulnerability may prove to be very critical for the company because TimesofMoney is India's one of the leaders in e-payment system. Existence of such a critical flaw in company's web may cause huge to the existing market reputation of the company concerned. At the end of their advisory the zSecure Group left a small message which claims that they have discovered alike vulnerability in HDFC Bank's website and in coming days the group may come up with the
CommonSense CMS Sql Injection Vulnerability

CommonSense CMS Sql Injection Vulnerability

November 03, 2010Mohit Kumar
Exploit Title: CommonSense CMS Sql Injection Vulnerability # Platform / Tested on: Win/Linux # category: webapps/0day # Code : https://[site]/article.php?article_id=[SQL] # Dork : "Powered by CommonSense CMS"
Damn Small SQLi Scanner (DSSS) v0.1b - 100 Lines Python Code

Damn Small SQLi Scanner (DSSS) v0.1b - 100 Lines Python Code

July 18, 2011Mohit Kumar
Damn Small SQLi Scanner (DSSS) v0.1b  - 100 Lines Python Code SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It happens from using Microsoft SQL or other poorly designed query language interpreters. Source Code : #!/usr/bin/env python import difflib, httplib, optparse, random, re, sys, urllib2, urlparse NAME = "Damn Small SQLi Scanner (DSSS) < 100 LOC (Lines of Code)" VERSION = "0.1b" AUTHOR = "Miroslav Stampar (https://unconciousmind.blogspot.com | @stamparm)" LICENSE = "GPLv2 (www.gnu.org/licenses/gpl-2.0.html)" NOTE = "This is a fully working PoC proving that commercial (SQLi) scanners can be beaten under 100 li
vBulletin Releases Patch Update for New RCE and SQLi Vulnerabilities

vBulletin Releases Patch Update for New RCE and SQLi Vulnerabilities

October 08, 2019Wang Wei
After releasing a patch for a critical zero-day remote code execution vulnerability late last month, vBulletin has recently published a new security patch update that addresses 3 more high-severity vulnerabilities in its forum software. If left unpatched, the reported security vulnerabilities, which affect vBulletin 5.5.4 and prior versions, could eventually allow remote attackers to take complete control over targeted web servers and steal sensitive user information. Written in PHP, vBulletin is a widely used proprietary Internet forum software package that powers over 100,000 websites on the Internet, including Fortune 500 and Alexa Top 1 million companies websites and forums. Discovered by application security researcher Egidio Romano, the first vulnerability, tracked as CVE-2019-17132 , is a remote code execution flaw, while the other two are SQL injection issues, both assigned a single ID as CVE-2019-17271 . vBulletin RCE and SQLi Flaws The RCE flaw resides in the w
Two US State Election Systems Hacked to Steal Voter Databases — FBI Warns

Two US State Election Systems Hacked to Steal Voter Databases — FBI Warns

August 30, 2016Mohit Kumar
A group of unknown hackers or an individual hacker may have breached voter registration databases for election systems in at least two US states, according to the FBI, who found evidence during an investigation this month. Although any intrusion in the state voting system has not been reported, the FBI is currently investigating the cyberattacks on the official websites for voter registration system in both Illinois and Arizona, said Yahoo News . The FBI's Cyber Division released a " Flash Alert " to election offices and officials across the United States, asking them to watch out for any potential intrusions and take better security precautions. "In late June 2016, an unknown actor scanned a state's Board of Election website for vulnerabilities using Acunetix, and after identifying a Structured Query Language (SQL) injection (SQLi) vulnerability, used SQLmap to target the state website," the FBI alert reads. "The majority of the data exfiltr
4XP Critical SQL Injection Vulnerability Exposed

4XP Critical SQL Injection Vulnerability Exposed

July 10, 2012Mohit Kumar
zSecure team has recently discovered a critical SQL Injection Vulnerability in the web portal of 4XP, a leading online forex broker having more than 1 lakh customer base. Financial transactions are carried on the broker's paltform on daily basis including but not limited to Credit Card Transactions. The critical vulnerability allows to get complete access to brokers database which can be misused to access their customers confidential information including their login id's, passwords, home address, email-id's, mobile no's, credit card details etc. This critical vulnerbility could prove devastating to the company if they doesn't fix it asap. Below are the details about the company & discovered vulnerability.   About the Company 4XP is an online forex broker that specializes in providing an all-inclusive trading package backed by a caring and devoted support team. 4XP was founded by a group of retail-ended entrepreneurs and capital market dealers sharing a vis
One million pages infected by Lilupophilupop SQL injection

One million pages infected by Lilupophilupop SQL injection

January 01, 2012Mohit Kumar
One million pages infected by Lilupophilupop SQL injection ISC (Internet Storm Center) reported that   lilupophilupop.com SQL injection attacks. There were about 80 pages infected according to Google searches few weeks back and now it raise to over 1 million . sites being injected with string : "></title><script src="https://lilupop******.com/**.php"></script>          Recommended Read :  The Hacker News Hacking Awards : Best of Year 2011            Infections are shows on .com, .de, & .uk as the most affected regions. ISC posted stats just to give you a rough idea of where the pages are: UK - 56,300 NL - 123,000 DE - 49,700 FR - 68,100 DK - 31,000 CN - 505 CA - 16,600 COM - 30,500 RU - 32,000 JP - 23,200 ORG - 2,690 If you want to find out if you have a problem just search for " <script src="https://lilupophi*****p.com/ " in google and use the site: parameter to hone in on your domain. [News Submitted by @om_bee ]
Sqlninja 0.2.6 is now available

Sqlninja 0.2.6 is now available

November 07, 2011Mohit Kumar
Sqlninja 0.2.6 is now available Sqlninja's goal is to exploit SQL injection vulnerabilities on web applications that use Microsoft SQL Server as back end. It is released under the GPLv3.There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network.  Here's what it does: Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode) Bruteforce of 'sa' password (in 2 flavors: dictionary-based and incremental) Privilege escalation to sysadmin group if 'sa' password has been found Creation of a custom xp_cmdshell if the original one has been removed Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed) TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port th
Metropolitan UK Police hacked for #Antisec by CSL Security using SQL injection Vulnerability

Metropolitan UK Police hacked for #Antisec by CSL Security using SQL injection Vulnerability

August 22, 2011Mohit Kumar
Metropolitan UK Police hacked for #Antisec by  CSL Security  using SQL injection Vulnerability One of the Anonymous Hacker " CSL Security " expose SQL Injection Vulnerability  in Metropolitan UK Police website via Twitter . He posted the stuff on Pastebin .  Vulnerable link is also posted by hacker. Where as no data has been published or leaked by Anonymous hackers yet. Yesterday  Danish Government database of 1,000,000 companies private info leaked by Hackers for Antisec Operation. Last week for OpBart - BART Police database hacked by Anonymous also.
zSecure - Web Security Consultancy Hacked by Mr52

zSecure - Web Security Consultancy Hacked by Mr52

August 12, 2011Mohit Kumar
zSecure - Web Security Consultancy Hacked by Mr52 ZSecure.net -  Web Security Consultancy services Provider hacked by Indian Hacker Mr52. Zsecure is the same firm who expose the Timesofmoney SQL Injection Vulnerability , Sify.com SQL Injection Vulnerability and Dukascopy.com SQL Injection Vulnerability , But there own site today got Hacked. Well, Zsecure currently take their site again back to normal homepage, But mirror of hack is available  here . Other Hacker By Mr52 can be seen here .
Sify.com hacked with SQL Injection Vulnerability

Sify.com hacked with SQL Injection Vulnerability

July 20, 2011Mohit Kumar
Sify.com hacked with SQL Injection Vulnerability Sify's website contain SQL injection Vulnerability and Hackers are able to Database Access, Database Dump, Possibility of shell uploading. Sify is one of India's leading integrated Information Communications Technology companies. Sify was one of the first private sector player to offer internet access, when internet access was opened to private sector. It leased international bandwidth from global vendors, domestic connectivity from telecom players and set up last mile connectivity by multiple methods: wi-fi connections using roof top antennae, copper connections using phone lines or cable TV connections. Sify also started providing internet network connectivity for business enterprises in India. Sify set up a chain of franchised internet cafes (today a network of over 3,300+ cybercafes). No data has been dumped by Hackers. Database has been accessed just to take screenshots so that we can make company believethat the vuln
Dukascopy: Forex Swiss Bank Vulnerable to SQL Injection

Dukascopy: Forex Swiss Bank Vulnerable to SQL Injection

July 06, 2011Mohit Kumar
Dukascopy: Forex Swiss Bank Vulnerable to SQL Injection SQL Injection Vulnerability found in Dukascopy by  zSecure Team. Dukascopy offers direct access to the Swiss Foreign Exchange Marketplace. This market provides the largest pool of ECN spot forex liquidity available for banks, hedge funds, other institutions and professional traders. To accommodate the existing banking relationships of it's clients, Dukascopy offers full Prime Broker capability with give up facility, by utilizing an extensive network of banking partners. Dukascopy Bank provides access to the very first Decentralized Marketplace technology (SWFX – Swiss Forex Marketplace), combining the liquidity of clients, centralized marketplaces and a number of banks. Through its marketplace solution, the Swiss Forex Bank & Marketplace proposes to every client to act as liquidity consumer and/or liquidity provider. Dukascopy Bank provides a transparent and anonymous trading environment. Proof Of Concept : Content Remov
Samsung Data Management Server with Sql Injection Login Bypass vulnerability

Samsung Data Management Server with Sql Injection Login Bypass vulnerability

May 09, 2011Mohit Kumar
Samsung Data Management Server with Sql Injection Login Bypass vulnerability Here we have one more example of human stupidity. Samsung Data Management Server with Sql Injection Login Bypass vulnerability . Anyone can easy hack into admin panel of server... here a screen shot of admin panel : Sorry ! We can't Disclose the location/URL of Panel just because of security reasons. But Samsung should fix this as soon as possible !
Hexjector 1.0.7.5 Rev34 Latest Version Download !

Hexjector 1.0.7.5 Rev34 Latest Version Download !

December 31, 2010Mohit Kumar
"Hexjector is an open-source, multi-platform PHP script to automate site penetration tests for SQL Injection Vulnerabilities." This is the updated change log: * Error_Check, HexDorker, HexaFind, HexDumper, HexaCurD, Hexdumpfile, Hexoutfile, Hexloader, and WAF_Detector have all been updated. * HexaFind is now multithreaded(Credits tDavid Hopkins for his CURL Class). * HexacURL removed. * Information.php is not used anymore. * Code is refined and organized for better view. * Output Buffering removed. * WAF Bypass Module Added. * HTTP Requests are now available. * POST * Interface of Hexjector is changed thanks tJohnburn, and mods from me. * A nonpersistent XSS is patched in HexDorker. * Codename Added. * RCE Test added. * Troubleshoot section added taid users in solving problems. * A new Manual Updater is added. * News Feeds Retriever. * Patch Retriever. * SQL Injection Type Detection is recoded tbe more precise. * Another Series of SQL Injection Type Detection are
Online Courses and Software

Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox daily.