Lucene search

K
packetstormShahab ShamsiPACKETSTORM:143544
HistoryJul 28, 2017 - 12:00 a.m.

Vehicle Workshop SQL Injection

2017-07-2800:00:00
Shahab Shamsi
packetstormsecurity.com
22
`# Exploit Title: VehicleWorkshop SQL Injection   
# Data: 07.28.2017  
# Exploit Author: Shahab Shamsi  
# Vendor HomagePage: https://github.com/spiritson/VehicleWorkshop  
# Tested on: Windows  
# Google Dork: N/A  
  
  
=========  
Vulnerable Page:  
=========  
/viewvehiclestoremore.php  
  
  
==========  
Vulnerable Source:  
==========  
Line5: if(isset($_GET['vahicleid']))  
Line7: $results = mysql_query("DELETE from vehiclestore where vehicleid ='$_GET[vahicleid]'");  
  
  
  
=========  
POC:  
=========  
http://site.com/viewvehiclestoremore.php?vahicleid=[SQL]  
  
  
  
=========  
Contact Me :  
=========  
Telegram : @Shahab_Shamsi  
Email : [email protected]  
WebSilte : WwW.iran123.Org  
  
  
  
  
`