Newsletter-Vorschau Plugin SQL Injection

2013.12.23

Credit: Emperor-Team

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

Dork: inurl:/mod_newsletter/preview.php?action=

##############
# Exploit Title : Newsletter-Vorschau Plugin SQL Injection
#
# Exploit Author : Emperor-Team
#
# Home : www.Emperor-team.org
#
#Link Plugin: www.conpresso4.de
#
# Security Risk : High 
#
# Dork : inurl:/mod_newsletter/preview.php?action=
#
# Tested on: Linux & Windows
#
##############
#
# Location: Target/mod_newsletter/preview.php?action=preview&nr=[Sql]
#
# Demo: http://bayernfXorum.de/mod_newsletter/preview.php?action=preview&nr=370
# 
# Demo2: http://cpmoXnitor.de/mod_newsletter/preview.php?action=preview&nr=4058
##############
#
# Mr.PERSIA
#
# Gmail:Persia.BlackHat@Gmail.CoM 
#
##############
#                                                                                     
# We Are: Mr.PERSIA . MR.F@RDIN . Explo!ter . Hidden Dagger . yazdanx7 . 
# 
# Dr.3v1l . N3RD . Mr_Bami . H0553|N7 . greendel . trojan . Mr.RaYaN . MaMaD_SeCreT
#
# yaghi.vahshi . H0$$E!N . tm_sd68 . _exe_ . MoHaMaD-VaKeR . Tir3x . &#7424;&#7437;&#618;&#640; &#969;&#7424;&#628;&#7451;&#7431;&#7429; . Phoenix_Killer . terrible_king 
#                                                                                     
#                
#############

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Newsletter-Vorschau Plugin SQL Injection

Dork: inurl:/mod_newsletter/preview.php?action=

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.