Peru Military Document Management System - sql inj

ctf · 03.05.2024

Hello XSS Community,
I'm selling Peru Military Document Management System SQL Injection in web portal letting you grab documents, users, passwords, etc
Server currently holding 50+ Dbs
Domain: mil.pe

ctf · 06.05.2024

Added proof:
Sample:
idpersona,foto,sexo,correo,estado,nombres,telefono,nrodocumento,fechacreacion,fk_iddocumento,apellidomaterno,apellidopaterno,usuariocreacion
465,https://5abrigada.fra1.digitaloceanspaces.com/documentos/42959_Cmdte Gral.jpg,M,mpazr@ejercito.mil.pe,*,MANUEL ANTONIO,995958613,6772830,2023-01-11 10:27:48,1,RAMOS,PAZ ,admin
466,https://5abrigada.fra1.digitalocean...HIPU.png,M,gñañag@ejercito.mil.pe,*,GUILLERMO RENATO,996998427,43332370,2023-01-11 10:15:57,1,GUERRA,ÑAÑA,admin
468,https://5abrigada.fra1.digitaloceanspaces.com/documentos/41441_FOTO P OLGUIN.jpg,M,eolguin@ejercito.mil.pe,A,EUGENIO OSCAR ANTONIO,995553358,19258879,2022-03-02 11:41:54,1,NORIEGA,OLGUIN,admin
512,https://5abrigada.fra1.digitalocean....jpg,M,caparcanaa@ejercito.mil.pe,A,CHRISTIAN LUIS,985263557,43368471,2022-03-01 13:16:28,1,AVALOS,APARCANA ,admin
864,https://qhipu.6abrigffee.com/assets/img/user.jpg,M,fitomilo2@hotmail.com,*,FERNANDO MARTIN,940620181,43251538,2022-03-02 11:42:16,1,BOGGIO,TASAYCO,admin
876,<blank>,M,<blank>,A,Usuario,<blank>,12345678,2023-08-16 10:07:51,1,<blank>,Cecom,admin
877,https://qhipu.5brigmtn.mil.pe/assets/img/user.jpg,M,<blank>,A,JAVIER,<blank>,10355135,2023-09-09 10:18:02,1,PAUCAR,HUAMAN,admin
878,https://qhipu.5brigmtn.mil.pe/assets/img/user.jpg,M,<blank>,A,WALTER,935522869,44221911,2022-03-11 19:10:52,1,ARI,COAQUIRA,admin
879,https://5abrigada.fra1.digitaloceanspaces.com/documentos/19929_My Lacotera.jpg,M,<blank>,*,CESAR,999454779,10439357,2023-01-06 20:26:54,1,SAAVEDRA,LA COTERA,admin

Sample:
idusuario,nick,pass,estado,usuario_2,fk_idperfil,fk_idpersona,fechacreacion,usuariocreacion
991,07490886,6c6816c8b10a821d676459c32e155fff,A,jema,18,1218,2023-03-02 09:22:41,admin
992,08889124,d3b94cdfd2d772636334ad2fb152d9de,A,jemo,18,1219,2023-03-02 09:24:35,admin
993,02792687,7cc00fa075ce14b048499f1942823ffb,A,inspectoria,18,1220,2023-07-18 14:22:12,admin
994,00474319,6b5f50f31c4f98f3e9750c0edd34a7f3,A,jinvestigaciones,16,1221,2023-03-02 09:25:30,admin
995,04647917,ca8816231cd9b4c09bfa6138e110bf7b,A,neginspecciones,15,1222,2023-03-02 09:25:47,admin
996,wmontesdeocah,202cb962ac59075b964b07152d234b70,A,<blank>,16,1223,2023-02-07 14:57:46,migracion
997,00509800,d4d2d9dcc293feac468edd6a0116eb33,A,jefesetel,16,1224,2023-04-10 15:55:31,admin

Sample:
id,tipo,email,name,password,personal,registro,created_at,updated_at,remember_token
10,2,JEMO@6FFEE,JEMO,$2y$10$F6THilQ5Sd7C2HuwMyuQ5OwGGheqxC3G77J3amLJzrnc.hE8J/B3i,NULL,0,2018-03-02 10:18:27,2018-10-17 10:58:16,niUyCHIrDugr7Qr4ck3v930BXPKntNODVTEaTsGKE9Q2090sqFKfvILmJlwA
11,2,INSPECTORIA@6FFEE,INSPECTORIA,$2y$10$/Xtvhted9zdy.fufTYr9J.1.DMltPT7a52U0Wth.UW2C2C2n2X2MK,NULL,0,2018-03-02 10:19:03,2018-10-17 10:58:28,eWNfPfDpKofDyjrYfUBoezyeWIOwlpJqbEjI2jaTr4hEHnedf6LSM9hKFYta
12,0,SEICI@JEMO,SEICI,$2y$10$p2JviSFy/g.9cXAPAMR5AuRU2ERGPaUSKDB3/D1D5EOc.dMxO1.oS,2,0,2018-03-02 10:29:13,2018-10-17 10:58:34,c5bp9Lw1Ck50udTen8D1MgWvVcDxkQjPTurpzIn9NdkdGJqXeYXZl6WAFJ9c
13,0,SIEDOC@JEMO,SIEDOC,$2y$10$95mr/C9Zj3g6u4YeRyJRJe7zg1obOlHADROFq.Hk1bf4NfsIFz6Xy,3,0,2018-03-02 10:30:11,2018-10-17 10:58:41,dpQlj2bXbajJught2kWeXsn4lvlUfTDQo94xJvWReMooeyP317DXKGqD5d0O
14,0,SEPLANO@JEMO,SEPLANO,$2y$10$stCadCVfbn4b5QiXgAOXV.G5xBLrnv0FoUKOG6Oqez7kn9QXmRITS,4,0,2018-03-02 10:35:17,2018-10-17 10:58:47,Iwi7G9OHQ36OazXpwiJNaOquPKY1ML1HBFwVXFTFiYKbiLi1gJR9p7ZLGm1G

of: