Scripts Genie Domain Trader (catalog.php, id param) - SQL Injection Vulnerability

2013-02-17 11:05:11

##################################################################################
__ _ _ ____
/ /___ _____ (_)_____________ ______(_)__ _____ / __ \_________ _
__ / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__ |__ ) /_/ / / / / __(__ )/ /_/ / / / /_/ /
\____/\__,_/_/ /_/_/____/____/\__,_/_/ /_/\___/____(_)____/_/ \__, /
/____/
##################################################################################
Domain Trader Script, MySQL Injection Vulnerabilities
Software Page: http://scriptsgenie.com/index.php?do=catalog&c=scripts&i=domain_trader_script_w%252Fparking
Script Demo: http://www.scriptsgenie.com/demo/trader/

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhats Inc. and Janissaries Platform.
##################################################################################

[~] MySQL Injection on Demo Site (/catalog.php?viewdomain=now&id=)

>>> http://server/catalog.php?viewdomain=now&id=1' (MySQLi Found)

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.