Easy Travel Portal SQL Injection

`  
  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ########################################## 1  
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1  
1 ########################################## 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1  
Author: L0rd CrusAd3r aka VSN [[email protected]]  
Exploit Title:Easy Travel Portal SQl Vulnerable  
Vendor url:http://www.softwebsnepal.com/  
Version:2  
Price:n/a  
Published: 2010-06-17  
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to  
all ICW members.  
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com  
  
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~  
  
Description  
  
Admin Panel:  
This software comes with admin panel form where you can check the number of  
listing and do the options like edit / delete . Admin can set email setting  
form the admin panel.  
  
  
Country list:  
Upload information of your travel country wise. You can upload country  
information like weather, culture, best to wear e.t.c so that to provide  
more information about each country for your Visitors.  
  
  
Hotel details / Travel information:  
Admin can upload hotel and travel details for each country like hotel photo,  
rates, hotel location , hotel facilites from admin panel so that visitors to  
the website can see all these when they log on to website. Since admin can  
upload photo, and update information about hotel's and travel plan, its easy  
to give new and updated information to customers.  
  
  
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~  
  
Vulnerability:  
  
*SQLi Vulnerability  
  
DEMO URL :  
  
http://www.mycheapdesign.com/traveldemo/tour_packages.asp?country=[sqli]  
  
http://www.mycheapdesign.com/traveldemo/hoteldetails.asp?id=[sqli]  
  
http://www.mycheapdesign.com/traveldemo/tourdetails.asp?id=[sqli]  
  
http://www.mycheapdesign.com/traveldemo/viewnews.asp?id=[sqli]  
  
  
# 0day n0 m0re #  
# L0rd CrusAd3r #  
  
  
--   
With R3gards,  
L0rd CrusAd3r  
  
  
  
`