29 lines
No EOL
1.2 KiB
Text
29 lines
No EOL
1.2 KiB
Text
-----------------------------------------------------------------------
|
|
Exploit Title : jSchool Advanced (SQL Injection) Vulnerability
|
|
Dork : inurl: "action=profil.main"
|
|
Found : 15 Jan '11
|
|
Author : eXa.DisC
|
|
Software : jSchool Advanced
|
|
(http://www.jogjacamp.com/script_4_Script_Website_Murah_Instant_Sekolah.html)
|
|
Price : Rp. 1.200.000
|
|
Vendor : http://jogjacamp.com
|
|
-----------------------------------------------------------------------
|
|
|
|
I. Demo Site
|
|
-----------------------------------------------------------------------
|
|
http://site/index.php?action=profil.main&xid=1
|
|
|
|
II. POC
|
|
-----------------------------------------------------------------------
|
|
http://site/index.php?action=profil.main&xid=[SQLi]
|
|
|
|
III. Vendor patch
|
|
-----------------------------------------------------------------------
|
|
Currently manufacturers do not provide patches or upgrades.
|
|
|
|
IV. Credits
|
|
-----------------------------------------------------------------------
|
|
- God
|
|
- bawahtanah_sii : tenro, sality23, em32, tdos, kiwill and my-Org
|
|
- XCODE - semua [komunitas IT dan netter] underground INDONESIA
|
|
- All Friend's and Enemy who know me |