Search...

Easy Travel Portal - SQL Injection

2010-06-17T00:00:00

ID EXPLOITPACK:F6FF3415C49E7C852BEF7AEED20EB230
Type exploitpack
Reporter L0rd CrusAd3r
Modified 2010-06-17T00:00:00

Description

Easy Travel Portal - SQL Injection

                                        
                                            Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Easy Travel Portal SQl Vulnerable
Vendor url:http://www.softwebsnepal.com/
Version:2
Price:n/a
Published: 2010-06-17
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description

Admin Panel:
This software comes with admin panel form where you can check the number of
listing and do the options like edit / delete . Admin can set email setting
form the admin panel.


Country list:
Upload information of your travel country wise. You can upload country
information like weather, culture, best to wear e.t.c so that to provide
more information about each country for your Visitors.


Hotel details / Travel information:
Admin can upload hotel and travel details for each country like hotel photo,
rates, hotel location , hotel facilites from admin panel so that visitors to
the website can see all these when they log on to website. Since admin can
upload photo, and update information about hotel's and travel plan, its easy
to give new and updated information to customers.


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO  :

http://server/traveldemo/tour_packages.asp?country=[sqli]

http://server/traveldemo/hoteldetails.asp?id=[sqli]

http://server/traveldemo/tourdetails.asp?id=[sqli]

http://server/traveldemo/viewnews.asp?id=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:13", "references": [], "description": "\nEasy Travel Portal - SQL Injection", "edition": 1, "reporter": "L0rd CrusAd3r", "exploitpack": {"type": "webapps", "platform": "php"}, "published": "2010-06-17T00:00:00", "title": "Easy Travel Portal - SQL Injection", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:13", "rev": 2}, "score": {"value": 0.3, "vector": "NONE", "modified": "2020-04-01T19:04:13", "rev": 2}, "vulnersScore": 0.3}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2010-06-17T00:00:00", "id": "EXPLOITPACK:F6FF3415C49E7C852BEF7AEED20EB230", "href": "", "viewCount": 2, "sourceData": "Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]\nExploit Title:Easy Travel Portal SQl Vulnerable\nVendor url:http://www.softwebsnepal.com/\nVersion:2\nPrice:n/a\nPublished: 2010-06-17\nGreetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to\nall ICW members.\nSpl Greetz to:inj3ct0r.com Team, Andhra hackers.com\n\n~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~\n\nDescription\n\nAdmin Panel:\nThis software comes with admin panel form where you can check the number of\nlisting and do the options like edit / delete . Admin can set email setting\nform the admin panel.\n\n\nCountry list:\nUpload information of your travel country wise. You can upload country\ninformation like weather, culture, best to wear e.t.c so that to provide\nmore information about each country for your Visitors.\n\n\nHotel details / Travel information:\nAdmin can upload hotel and travel details for each country like hotel photo,\nrates, hotel location , hotel facilites from admin panel so that visitors to\nthe website can see all these when they log on to website. Since admin can\nupload photo, and update information about hotel's and travel plan, its easy\nto give new and updated information to customers.\n\n\n~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~\n\nVulnerability:\n\n*SQLi Vulnerability\n\nDEMO :\n\nhttp://server/traveldemo/tour_packages.asp?country=[sqli]\n\nhttp://server/traveldemo/hoteldetails.asp?id=[sqli]\n\nhttp://server/traveldemo/tourdetails.asp?id=[sqli]\n\nhttp://server/traveldemo/viewnews.asp?id=[sqli]\n\n\n# 0day n0 m0re #\n# L0rd CrusAd3r #\n\n\n-- \nWith R3gards,\nL0rd CrusAd3r", "cvss": {"score": 0.0, "vector": "NONE"}, "immutableFields": []}