“Finde mit StayFriends – der Freunde-Suchmaschine – ehemalige Klassenkameraden, Kollegen, Absolventen, alte Liebschaften und verschollene Freunde wieder !”

A very popular website in Germany with branches throughout Europe and over the Ocean in countries like Sweden, France, Austria, USA and Canada. 

This is a site with some 7.540.881 registered users. (Die Nr. 1 in Deutschland mit 7.540.881 Mitgliedern) (No 1 in Germany with 7.540.881 members) 

It is a meeting place for graduates, classmates, and friends. Unfortunately   this site is guilty of the same sin as the others we’ve been dealing with in the recent past. Take one of the paramters, modify it, and you gain access to a behemoth database.

Lets see the usernames and passwords for mysql.user:

As a proof of the large number of registered users in the Person data base i made a screenshot with the name, email and password of the 6.000.000th user.

In the database you can also find some data about CC (credit card):

As well as the name, address, email and social security number (SSN) of those users:

RO version:

“Finde mit StayFriends – der Freunde-Suchmaschine – ehemalige Klassenkameraden, Kollegen, Absolventen, alte Liebschaften und verschollene Freunde wieder !”
Un site foarte popular in Germania cu sectiuni in Suedia, Franta, Austria, USA si Canada. Un site care are 7.540.881 de useri inregistrati. (Die Nr. 1 in Deutschland mit 7.540.881 Mitgliedern )
Un site de intalniri pentru absolventi, fosti colegi de clasa, prieteni. Un site care din cauza unui parametru prost sanitizat permite full acces la o baza de date imensa.
Sa vedem username si parolele pentru mysql.user:

Drept dovada pentru numarul mare de inregistrati din baza de date Person (persoane) am facut un print screen cu numele, emailul si parola userului cu numarul de inregistrare 6.000.000

In baza de date se mai gasesc si niste date partiale de card:

Cat si numele, adresa , emailul si socialsecuritynumber (ssn)-ul persoanelor respective:

Mi-am permis sa nu blurez sintaxa sqli din poze deoarece vulnerabilitatea a fost rezolvata si parametrul este securizat.

Related Posts

• February 23, 2011 -- Concurs fara premii
• August 30, 2010 -- Deface (?!?) pe Cotidianul.ro
• April 21, 2010 -- France2.fr – France4.fr – in asteptarea atacului?
• December 24, 2009 -- Forumul Andreei Balan spart
• December 22, 2009 -- Fun cu NemoExpres.ro