Check Server Vulnerability Messenger - SQL Injection

[FlorinMarian 144]

M2 Download Center

This is the hidden content, please

• Sign In
• or
• Sign Up

( Internal )

Hello devs!

 

I've found this tutorial on another Metin2Forum(doesn't matter which one, I'M NOT THE ORIGINAL POSTER) !

I think it can be userful for peoples which use diffs to fix this vulnerability and they don't know sure if the diff works or not.

 

Spoiler

 

How to do ?

1.Download this python DLL (see in your client if it's using 2.2 or 2.7):

Python22

Python27

 

2. Log in to navicat, database player and after press 'CTRL+Q':

Paste this code and click 'RUN'

Spoiler

DROP TABLE IF EXISTS `test`;
CREATE TABLE `test` (
  `name` varchar(255) NOT NULL,
  PRIMARY KEY (`name`)
) ;

INSERT INTO `test` VALUES ('A');
INSERT INTO `test` VALUES ('Caso');
INSERT INTO `test` VALUES ('Parole');
INSERT INTO `test` VALUES ('Scrivendo');
INSERT INTO `test` VALUES ('Sto');

 3.Login to client with anny account(isn't necessary to be GM) and you will see this noticebox:

Spoiler

4. Press F9 and will see these mesages:

Spoiler

 

 

Spoiler

 

6. Now Login again to Navicat , database player and open table test. If that table it's empty(don't have anny record) your server was succesfully injected, so you are still vulnerable.

 

Hope it works for all of you !

 

Edited July 26, 2021 by FlorinMarian

[alondark 68]

godd ++ 

[misterioso 5]

I'm happy... Finally someone appreciates my small tool... >.<

In the original forum nobody said anything about it and for this reason I didn't post in other forums.

 

Thank you for sharing,

Misterioso

[kingshero 8]

On 7/22/2016 at 6:19 PM, misterioso said:

I'm happy... Finally someone appreciates my small tool... >.<

In the original forum nobody said anything about it and for this reason I didn't post in other forums.

 

Thank you for sharing,

Misterioso

you is good man

[Metin2 Dev 12260]

My server automatically give me ban after injecting 

[danhakhavro 45]

Quote

If that table it's empty(don't have anny record) your server was succesfully injected, so you are still vulnerable.

 

What should happen if you are not vulnerable?

[ryanjoex 0]

thanks